A Transfer Learning Approach for Network Intrusion Detection

Abstract

Convolution Neural Network (ConvNet) offers a high potential to generalize input data. It has been widely used in many application areas, such as visual imagery, where comprehensive learning datasets are available and a ConvNet model can be well trained and perform the required function effectively. ConvNet can also be applied to network intrusion detection. However, the currently available datasets related to the network intrusion are often inadequate, which makes the ConvNet learning deficient, hence the trained model is not competent in detecting unknown intrusions. In this paper, we propose a ConvNet model using transfer learning for the network intrusion detection. The model consists of two concatenated ConvNets and is built on a two-stage learning process: learning a base dataset and transferring the learned knowledge to the learning of the target dataset. Our experiments on the NSL-KDD dataset show that the proposed model can improve the detection accuracy not only on the test dataset containing mostly known attacks (KDDTest+) but also on the test dataset featuring many novel attacks (KDDTest-21) -about 2.68% improvement on KDDTest+ and 22.02% on KDDTest-21 can be achieved, as compared to the traditional ConvNet model.

Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective

“…In the domain of cybersecurity, it also plays an important role due to its various advantages in modeling like saving training time, improving the accuracy of output, and the need for lesser training data. For instance, the authors in [114] present a ConvNet model using transfer learning for network intrusion detection. In [115], the authors propose a signature generation method based on deep feature transfer learning that dramatically reduces signature generation and distribution time.…”

“…Langin et al [84], Le et al [86] , Malondkar et al [85] Auto Encoder (AE) feature learning model, insider threat detection, malware detection, intrusion detection system Yousefi et al [92], Liu et al [93], Wang et al [94], Yan et al [95] Restricted Boltzmann Machine (RBM) network anomaly detection, DoS attack detection, intrusion detection Fiore et al [99], Imamverdiyev et al [100], Mayuranathan et al [125], Alom et al [126] Deep Belief Networks (DBN) intrusion detection system and optimization, phishing detection, malware detection Salama et al [104], Qu et al [105], Wei et al [103], Yi et al [127], Arshey et al [128], Saif et al [129], Hou et al [130] Generative Adversarial Network (GAN) zero-day malware detection, botnet detection, intrusion detection systems Kim et al [108], Li et al [110], Yin et al [109], Merino et al [111] Deep Transfer Learning (DTL or Deep TL) intrusion detection system, detecting unknown network attacks, malware detection, malicious software classification Wu et al [114], Zhao et al [117], Gao et al [118], Rezende et al [119] Deep Reinforcement Learning (DRL or deep RL) intrusion detection system, malware detection, Security and Privacy Lopez et al [131], Sethi et al [132], Fang et al [133], Shakeel et al [134] the quality of the security data and the performance of the learning algorithms.…”

Machine Learning for Misuse-Based Network Intrusion Detection: Overview, Unified Evaluation and Feature Choice Comparison Framework

“…In [106], researchers examine the possibilities of transfer learning for intrusion detection. Concretely, the authors first train a base CNN on UNSW-NB15, which then remains fixed to train a second CNN that is added onto the first.…”

Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective

“…In the domain of cybersecurity, it also plays an important role due to its various advantages in modeling like saving training time, improving the accuracy of output, and the need for lesser training data. For instance, the authors in [131] present a ConvNet model using transfer learning for network intrusion detection. In [89], the authors propose a signature generation method based on deep feature transfer learning that dramatically reduces signature generation and distribution time.…”