A Novel Multimodal-Sequential Approach Based on Multi-View Features for Network Intrusion Detection

Abstract

Network intrusion detection systems (NIDS) are essential tools in ensuring network information security, and neural networks have become an increasingly popular solution for NIDS. However, with the gradual complexity of the network environment, the existing solutions using the conventional neural network cannot make full use of the rich information in the network traffic data due to its single structure. More importantly, this will lead to the existing NIDS have incomplete knowledge of the intrusion detection domain, and making it unable to achieve a high detection rate and good stability in the new environment. In this paper, we take a step forward and extract the different level features from the network connection, rather than a long feature vector used in the traditional approach, which can process feature information separately more efficiently. And further, we propose multimodal-sequential intrusion detection approach with special structure of hierarchical progressive network, which is supported by multimodal deep auto encoder (MDAE) and LSTM technologies. By design the special structure of hierarchical progressive network, our approach can efficiently integrate the different level features information within a network connection and automatically learn temporal information between adjacent network connections at the same time. Based on the three benchmark datasets from 1999 to 2017, including NSL-KDD, UNSW-NB15, and CICIDS 2017, we investigated the performance of our proposed approach on the task of detecting attacks within modern network. The experimental results show that the average accuracy of this method is 94% in binary classification and 88% in multi-class classification, which is at least 2% and 4% super than other methods respectively, and demonstrated that our model has excellent stability. Moreover, we further explore the multimodality and complementarity in traffic data, the experimental results show that the performance of detection model can be further improved in the range 2% to 5% when using our MDAE model to process the features of traffic data.INDEX TERMS Network anomaly detection, hierarchical progressive network, multimodal deep learning.

Intelligent Cyber Attack Detection and Classification for Network-Based Intrusion Detection Systems

“…In [3], He et al, proposed a combination of a Multimodal Deep Auto Encoder (MDAE) and an LSTM for conducting anomaly detection. This novel approach was tested on three datasets from 1999 to 2017, namely, NSL-KDD, UNSW-NB15 and CICIDS2017 achieving, for multi-class classification, accuracy scores of 80.20%, 86.20% and 98.60%, respectively.…”

“…The latter, also known as misuse detection, attempts to detect and classify attacks by matching predefined patterns. Although maintaining reasonable levels of false alarm rates, this technique is only suitable for well-known attacks [3]. To overcome this disadvantage, some researchers have developed flexible signature-based NIDS [4,5].…”

Untitled

“…In the same vein, in He et al [59], authors extracted various levels of features from the network connection (the opposite of traditional long feature vectors) in order to process information more efficiently separately. They also present a multi-modalsequential IDS supported by multi-modal deep auto-encoder and LSTM technologies, which provide the advantage of automatically learning temporal information between connections amongst adjacent networks.…”

Intelligent Cyber-Attack Detection and Classification for Network-based Intrusion Detection Systems

“…In [3], He et al, proposed a combination between a Multimodal Deep Auto Encoder (MDAE) and a LSTM for conducting anomaly detection. This novel approach was tested on three datasets from 1999 to 2017, namely, NSL-KDD, UNSW-NB15 and CICIDS2017 achieving, for multi-class classification, accuracy scores of 80.20%, 86.20% and 98.60%, respectively.…”

“…The last, also known as misuse detection, attempts to detect and classify attacks by matching predefined patterns. This technique although maintaining reasonable levels of false alarms rates it is only good for well-known attacks [3]. In order to overcome this disadvantage some researchers have developed flexible signature-based NIDS [4,5].…”