An Intrusion Detection Model With Hierarchical Attention Mechanism

Abstract

Network security has always been a hot topic as security and reliability are vital to software and hardware. Network intrusion detection system (NIDS) is an effective solution to the identification of attacks in computer and communication systems. A necessary condition for high-quality intrusion detection is the gathering of useful and precise intrusion information. Machine learning, particularly deep learning, has achieved a lot of success in various fields of industry and academic due to its good ability of feature representation and extraction. In this paper, deep learning methods are integrated into the NIDS. The intrusion activity is regarded as a time-series event and a bidirectional gated recurrent unit (GRU) based network intrusion detection model with hierarchical attention mechanism is presented. The influence of different lengths of previous traffic on the performance is then studied. Some experiments are performed on the dataset UNSW-NB15, in which the proposed hierarchical attention model achieves satisfactory detection accuracy of more than 98.76% and a false alarm rate (FAR) of lower than 1.2%. An attention probability map to reflect the importance of features is then visualized using the attention mechanism. The visualization ability assists in providing an understanding of the varied importance of the same features for different traffic classes and to determine feature selection in the future.

A Comprehensive Survey on Intrusion Detection based Machine Learning for IoT Networks

“…The training phase learns the features distribution and generates a model able to detect patterns. Then, in the testing phase, the model is applied to detect any abnormality [135][136][137]. This section builds taxonomy for different ML techniques that can be used in the IDS context .…”

The Effective Methods for Intrusion Detection With Limited Network Attack Data: Multi-Task Learning and Oversampling

“…In order to obtain high accuracy, high packet detection rate, and low false positive rate of AID-S, Iwendi et al [11] proposed a CFS + Ensemble Classifiers. Besides, Jiang et al [12] proposed the PSO-XGBoost model given its overall higher classification accuracy than other alternative models such like XGBoost, Random Forest, Bagging and Adaboost and Liu et al [13] presented an intrusion detection model with hierarchical attention mechanism.…”

Building an Intrusion Detection System to Detect Atypical Cyberattack Flows

“…A RTIFICIAL Intelligence provides powerful solutions for improving cybersecurity in general, and intrusion detection systems [1], [2] in particular due to improvement in attack detection rates, precision, and recall as well as the reduction in false positives and negatives. Such techniques have also been applied successfully in network analytics to analyze complex encrypted traffic flows [3], [4].…”