AI-IDS: Application of Deep Learning to Real-Time Web Intrusion Detection

Kim, Ae Chan; Park, Mohyun; Lee, Dong Hoon

doi:10.1109/access.2020.2986882

Cited by 165 publications

(71 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…To calculate the selected evaluation method, confusion matrix metrics were used, which are commonly used in machine learning. As shown in Table 5, the confusion matrix [55] comprises four information points. Based on these four information points, four scales can be evaluated, as shown in Table 6 [55].…”

Section: Evaluation Environment and Metricsmentioning

confidence: 99%

PF-TL: Payload Feature-Based Transfer Learning for Dealing with the Lack of Training Data

2021

View full text Add to dashboard Cite

The number of studies on applying machine learning to cyber security has increased over the past few years. These studies, however, are facing difficulties with making themselves usable in the real world, mainly due to the lack of training data and reusability of a created model. While transfer learning seems like a solution to these problems, the number of studies in the field of intrusion detection is still insufficient. Therefore, this study proposes payload feature-based transfer learning as a solution to the lack of training data when applying machine learning to intrusion detection by using the knowledge from an already known domain. Firstly, it expands the extracting range of information from header to payload to accurately deliver the information by using an effective hybrid feature extraction method. Secondly, this study provides an improved optimization method for the extracted features to create a labeled dataset for a target domain. This proposal was validated on publicly available datasets, using three distinctive scenarios, and the results confirmed its usability in practice by increasing the accuracy of the training data created from the transfer learning by 30%, compared to that of the non-transfer learning method. In addition, we showed that this approach can help in identifying previously unknown attacks and reusing models from different domains.

show abstract

Section: Evaluation Environment and Metricsmentioning

confidence: 99%

PF-TL: Payload Feature-Based Transfer Learning for Dealing with the Lack of Training Data

2021

View full text Add to dashboard Cite

show abstract

“…In addition, neural network and other deep learning methods are used in network intrusion detection. Kim et al [8] proposed an Artificial Intelligence-based Intrusion Detection System (AIIDS), which is an optimal CNN-LSTM model based on spatial feature learning and successfully applied payload-level deep learning techniques in a highperformance computing environment. In order to better protect the privacy issues of the security operation centers, Khayati et al [14] developed a protocol for privately evaluating detection models on the system data, in which privacy of both the system data and detection models is protected and information leakage is either prevented altogether or quantifiably decreased.…”

Section: A Intrusion Detection Systemmentioning

confidence: 99%

“…Its basic idea is to detect anomaly behaviors that deviate from the normal features or distributions of network traffic, which facilitates and enables the identification of unknown attacks [5]. Recently, many advanced machine learning algorithms VOLUME 4, 2016 have been successfully implemented to enhance the performance of AIDSs [6]- [8].…”

Section: Introductionmentioning

confidence: 99%

The Effective Methods for Intrusion Detection With Limited Network Attack Data: Multi-Task Learning and Oversampling

et al. 2020

View full text Add to dashboard Cite

Recently, many anomaly intrusion detection algorithms have been developed and applied in network security. These algorithms achieve high detection rate on many classical datasets. However, most of them failed to address two challenges: 1) imbalanced traffic data with limited network attack, 2) multiple data sources that are distributed in different terminals. In detail, those algorithms assume that there are sufficient network traffic data to train their models for intrusion detection. Due to the network attack traffic is always scarce in the real-world network, this assumption is difficult to satisfy in most cases. In this paper, we use Multi-Task Learning (MTL) and oversampling methods to address those challenges of network intrusion detection. Firstly, we use the MTL method to treat each terminal as a single task, and then use relevant information between different terminals to help learn every single task. Meanwhile, we use the oversampling method to overcome the minority problem of attacks. Through a series of experiments on the latest UNSW-NB15 and CICIDS2018 datasets, this paper verifies the effectiveness of MTL and oversampling methods for network intrusion detection with limited network attack data, where they achieve more than 90% detection rate in different experimental settings.

show abstract

“…In recent years, with the prosperity and development of machine learning techniques, more and more researcher try to use machine learning method to deal with IDS problem [13]- [16]. Lots of scholars have used Support Vector Machine (SVM) [17]- [19], Convolutional Neural Network (CNN) [20]- [23], Recurrent Neural Network (RNN) [24], [25], Long Short-Term Memory (LSTM) [26]- [30],Gated Recurrent Unit (GRU) [34]- [36], ensemble learning method [31]- [33],especially Gradient Boosting Decision Tree (GBDT) [37]- [41] and many other kinds of machine learning meth-ods in IDS. Those methods have efficiently improved the classification accuracy.…”

Section: Introductionmentioning

confidence: 99%

A GBDT-Paralleled Quadratic Ensemble Learning for Intrusion Detection System

2020

View full text Add to dashboard Cite

The development of computer and network technology has provided convenience to our daily life, however, attack and intrusion in network emerge endlessly. Intrusion Detection System (IDS) has been developed to confront network attacks. As a result, the research of IDS is one of the most popular fields in recent years. This paper proposes a Gradient Boosting Decision Tree (GBDT)-paralleled quadratic ensemble learning method for intrusion detection system. We use GBDT to deal with the spatial part of traffic data and use Gated Recurrent Unit (GRU) model with special modification for network traffic to deal with temporal data. Then, in order to combine the spatial feature and temporal feature, we fuse GBDT model and GRU model to make a quadratic ensemble model as our final intrusion detection system. The experimental results based on CICIDS2017 dataset show that the advanced spatial-temporal intrusion detection system based on ensemble learning achieves better accuracy, recall, precision and F1 score than the state-of-the-art methods. The accuracies of detecting benign, port scan, Distributed Denial of Service (DDoS), infiltration and web attack traffic are up to 99.9%, 99.9%, 99.9%, 99.9%, and 99.9%, respectively. We also use our method in Information-Centric Networking (ICN) dataset and the results show our method achieves much better performance compared with existing methods.

show abstract

AI-IDS: Application of Deep Learning to Real-Time Web Intrusion Detection

Cited by 165 publications

References 29 publications

PF-TL: Payload Feature-Based Transfer Learning for Dealing with the Lack of Training Data

PF-TL: Payload Feature-Based Transfer Learning for Dealing with the Lack of Training Data

The Effective Methods for Intrusion Detection With Limited Network Attack Data: Multi-Task Learning and Oversampling

A GBDT-Paralleled Quadratic Ensemble Learning for Intrusion Detection System

Contact Info

Product

Resources

About