An Intrusion Detection Model based on a Convolutional Neural Network

Abstract

Machine-learning techniques have been actively employed to information security in recent years. Traditional rule-based security solutions are vulnerable to advanced attacks due to unpredictable behaviors and unknown vulnerabilities. By employing ML techniques, we are able to develop intrusion detection systems (IDS) based on anomaly detection instead of misuse detection. Moreover, threshold issues in anomaly detection can also be resolved through machine-learning. There are very few datasets for network intrusion detection compared to datasets for malicious code. KDD CUP 99 (KDD) is the most widely used dataset for the evaluation of IDS. Numerous studies on ML-based IDS have been using KDD or the upgraded versions of KDD. In this work, we develop an IDS model using CSE-CIC-IDS 2018, a dataset containing the most up-to-date common network attacks. We employ deep-learning techniques and develop a convolutional neural network (CNN) model for CSE-CIC-IDS 2018. We then evaluate its performance comparing with a recurrent neural network (RNN) model. Our experimental results show that the performance of our CNN model is higher than that of the RNN model when applied to CSE-CIC-IDS 2018 dataset. Furthermore, we suggest a way of improving the performance of our model.

A Novel Intrusion Detection Model for Detecting Known and Innovative Cyberattacks Using Convolutional Neural Network

“…In [9], a CNN based IDS was proposed by Jiyeon Kim et al In this paper, the authors employed deep learning techniques and developed a CNN model for the CICIDS2018 dataset, which was a dataset sharing the same feature set with CICIDS2017 but with larger sample counts. The training and test of the models in the study were performed on subdatasets which included a subset of types of network traffic from CICIDS2018.…”

“…However, from [7]- [9], it is observed that CNN, albeit with its merits at generalize complex patterns of features in the dataset, has some potential issues at multi-class classifications. The CNN models proposed in these studies are tested on classification tasks of either one-class or a subset of classes in the dataset.…”

“…CNN has many layers to be implemented and some parameters to be selected before training one. Empirically, the number of convolution and fully connected layers for a CNN for network intrusion detection tasks could be selected from the range of 1 ~ 3 layers each [8], [9], [20]. In general, the more complex the task assigned to a neural network, the more layers are added.…”

“…In this paper, an IDS for cybersecurity based on the Convolutional Neural Network (CNN) architecture is proposed. Unlike some previously proposed CNN based IDS, which mostly aiming one-class or a subset of classes classification of the CICIDS2017 dataset [7]- [9]. The proposed IDS has high performance at multi-class classification, for identifying innovative and all the known attack classes in a dataset.…”

Performance analysis of flow-based attacks detection on CSE-CIC-IDS2018 dataset using deep learning

“…In paper [14] the deep learning algorithms capabilities in the network intrusion detection is explored. It compared varity of deep learning frameworks (e.g., TensorFlow,Keras, PyTorch, Theanoand fast.ai) for network traffic intrusion detecting and network attack types classifying .In [15]CIC-2018 dataset and proposed convolutional neural network (CNN) model is implemented, which converted dataset to images, each one in size 13× 6 due to 78 features for each data without the feature Label which used for image classification.…”