Deep learning approaches for anomaly-based intrusion detection systems: A survey, taxonomy, and open issues

Aldweesh, Arwa; Derhab, Abdelouahid; Emam, Ahmed

doi:10.1016/j.knosys.2019.105124

Cited by 439 publications

(214 citation statements)

References 32 publications

Supporting

Mentioning

187

Contrasting

Unclassified

Order By: Relevance

“…Since a considerable amount of literature exists in the broad area of network intrusion detection, this inclusion criteria has been adopted for selection of most recent and highly relevant papers for this study. Interested readers can refer to surveys on broad area of detection of DDoS attacks available in [12], [13], [14].…”

Section: Related Workmentioning

confidence: 99%

“…Various solutions based on packet-level analyses, flowlevel analyses, behavioral analyses, traffic mining and deep packet inspection of network traffic, have been proposed by researchers for combating DDoS attacks [6]- [11]. Recent advances in machine learning and deep learning techniques have also been employed for detection of DDoS attacks [12]- [14].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Hyperband Tuned Deep Neural Network With Well Posed Stacked Sparse AutoEncoder for Detection of DDoS Attacks in Cloud

2020

View full text Add to dashboard Cite

Cloud computing has very attractive features like elastic, on demand and fully managed computer system resources and services. However, due to its distributed and dynamic nature as well as vulnerabilities in virtualization implementation, the cloud environment is prone to various cyber-attacks and security issues related to cloud model. Some of them are inability to access data coming to and from cloud service, theft and misuse of data hosted, no control over sensitive data access, advance threats like malware injection attack, wrapping attacks, virtual machine escape, distributed denial of service attack (DDoS) etc. DDoS is one of the notorious attack. Despite a number of available potential solutions for the detection of DDoS attacks, the increasing frequency and potency of recent attacks and the constantly evolving attack vectors, necessitate the development of improved detection approaches. This paper proposes a novel architecture that combines a well posed stacked sparse AutoEncoder (AE) for feature learning with a Deep Neural Network (DNN) for classification of network traffic into benign traffic and DDoS attack traffic. AE and DNN are optimized for detection of DDoS attacks by tuning the parameters using appropriately designed techniques. The improvements suggested in this paper lead to low reconstruction error, prevent exploding and vanishing gradients, and lead to smaller network which avoids overfitting. A comparative analysis of the proposed approach with ten state-of-the-art approaches using performance metrics-detection accuracy, precision, recall and F1-Score, has been conducted. Experiments have been performed on CICIDS2017 and NSL-KDD standard datasets for validation. Proposed approach outperforms existing approaches over the NSL-KDD dataset and yields competitive results over the CICIDS2017 dataset.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Hyperband Tuned Deep Neural Network With Well Posed Stacked Sparse AutoEncoder for Detection of DDoS Attacks in Cloud

2020

View full text Add to dashboard Cite

show abstract

“…Security information event management solutions [127], [128], [157] utilize ML to detect ongoing security threats, anomalies, and intrusions in network elements and orchestrate automated responses. Human approval and surveillance can be part of reactive ML-based security solutions, particularly when the correct autonomous behavior in every situation cannot be trusted.…”

Section: ) Reactive Defenses In 5g Platformsmentioning

confidence: 99%

Machine Learning Threatens 5G Security

et al. 2020

View full text Add to dashboard Cite

Machine learning (ML) is expected to solve many challenges in the fifth generation (5G) of mobile networks. However, ML will also open the network to several serious cybersecurity vulnerabilities. Most of the learning in ML happens through data gathered from the environment. Un-scrutinized data will have serious consequences on machines absorbing the data to produce actionable intelligence for the network. Scrutinizing the data, on the other hand, opens privacy challenges. Unfortunately, most of the ML systems are borrowed from other disciplines that provide excellent results in small closed environments. The resulting deployment of such ML systems in 5G can inadvertently open the network to serious security challenges such as unfair use of resources, denial of service, as well as leakage of private and confidential information. Therefore, in this article we dig into the weaknesses of the most prominent ML systems that are currently vigorously researched for deployment in 5G. We further classify and survey solutions for avoiding such pitfalls of ML in 5G systems.

show abstract

“…In addition, with the proliferation of DNN and its deployment in different fields and applications, a set of works has been proposed in the literature to assess its applicability for anomaly detection [49,50]. In this context, deep learning-based abnormality detection solutions receive an increasing interest [51].…”

Section: Machine Learning-based Techniquesmentioning

confidence: 99%

A Novel Approach for Detecting Anomalous Energy Consumption Based on Micro-Moments and Deep Neural Networks

et al. 2020

View full text Add to dashboard Cite

Nowadays, analyzing, detecting, and visualizing abnormal power consumption behavior of householders are among the principal challenges in identifying ways to reduce power consumption. This paper introduces a new solution to detect energy consumption anomalies based on extracting micro-moment features using a rule-based model. The latter is used to draw out load characteristics using daily intent-driven moments of user consumption actions. Besides micro-moment features extraction, we also experiment with a deep neural network architecture for efficient abnormality detection and classification. In the following, a novel anomaly visualization technique is introduced that is based on a scatter representation of the micro-moment classes, and hence providing consumers an easy solution to understand their abnormal behavior. Moreover, in order to validate the proposed system, a new energy consumption dataset at appliance level is also designed through a measurement campaign carried out at Qatar University Energy Lab, namely, Qatar University dataset. Experimental results on simulated and real datasets collected at two regions, which have extremely different climate conditions, confirm that the proposed deep micro-moment architecture outperforms other machine learning algorithms and can effectively detect anomalous patterns. For example, 99.58% accuracy and 97.85% F1 score have been achieved under Qatar University dataset. These promising results establish the efficacy of the proposed deep micro-moment solution for detecting abnormal energy consumption, promoting energy efficiency behaviors, and reducing wasted energy.

show abstract

Deep learning approaches for anomaly-based intrusion detection systems: A survey, taxonomy, and open issues

Cited by 439 publications

References 32 publications

Hyperband Tuned Deep Neural Network With Well Posed Stacked Sparse AutoEncoder for Detection of DDoS Attacks in Cloud

Hyperband Tuned Deep Neural Network With Well Posed Stacked Sparse AutoEncoder for Detection of DDoS Attacks in Cloud

Machine Learning Threatens 5G Security

A Novel Approach for Detecting Anomalous Energy Consumption Based on Micro-Moments and Deep Neural Networks

Contact Info

Product

Resources

About