Deep Learning in Intrusion Detection Systems

Karataş, Gözde; Demir, Önder; Şahingöz, Özgür Koray

doi:10.1109/ibigdelft.2018.8625278

Cited by 110 publications

(44 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Deep learning is said to be one of the best approaches, which can be used in IDS due to the fact that its training duration is less and accuracy is better. The authors in [15] survey different deep learning approaches incorporated in IDS and present a comparative analysis of the same.…”

Section: Related Workmentioning

confidence: 99%

A Novel PCA-Firefly Based XGBoost Classification Model for Intrusion Detection in Networks Using GPU

et al. 2020

View full text Add to dashboard Cite

The enormous popularity of the internet across all spheres of human life has introduced various risks of malicious attacks in the network. The activities performed over the network could be effortlessly proliferated, which has led to the emergence of intrusion detection systems. The patterns of the attacks are also dynamic, which necessitates efficient classification and prediction of cyber attacks. In this paper we propose a hybrid principal component analysis (PCA)-firefly based machine learning model to classify intrusion detection system (IDS) datasets. The dataset used in the study is collected from Kaggle. The model first performs One-Hot encoding for the transformation of the IDS datasets. The hybrid PCA-firefly algorithm is then used for dimensionality reduction. The XGBoost algorithm is implemented on the reduced dataset for classification. A comprehensive evaluation of the model is conducted with the state of the art machine learning approaches to justify the superiority of our proposed approach. The experimental results confirm the fact that the proposed model performs better than the existing machine learning models.

show abstract

Section: Related Workmentioning

confidence: 99%

A Novel PCA-Firefly Based XGBoost Classification Model for Intrusion Detection in Networks Using GPU

et al. 2020

View full text Add to dashboard Cite

show abstract

“…KDD Cup99 was created in 1998 by DARPA to detect anomaly network traffic and was used in the 1999 KDD Cup Challenge to test IDSs [16], [17]. In its construction, nine weeks of LAN raw data which results in a TCP dump are used.…”

Section: A Kdd Cup99mentioning

confidence: 99%

Increasing the Performance of Machine Learning-Based IDSs on an Imbalanced and Up-to-Date Dataset

2020

Self Cite

View full text Add to dashboard Cite

In recent years, due to the extensive use of the Internet, the number of networked computers has been increasing in our daily lives. Weaknesses of the servers enable hackers to intrude on computers by using not only known but also new attack-types, which are more sophisticated and harder to detect. To protect the computers from them, Intrusion Detection System (IDS), which is trained with some machine learning techniques by using a pre-collected dataset, is one of the most preferred protection mechanisms. The used datasets were collected during a limited period in some specific networks and generally don't contain up-to-date data. Additionally, they are imbalanced and cannot hold sufficient data for all types of attacks. These imbalanced and outdated datasets decrease the efficiency of current IDSs, especially for rarely encountered attack types. In this paper, we propose six machine-learning-based IDSs by using K Nearest Neighbor, Random Forest, Gradient Boosting, Adaboost, Decision Tree, and Linear Discriminant Analysis algorithms. To implement a more realistic IDS, an up-to-date security dataset, CSE-CIC-IDS2018, is used instead of older and mostly worked datasets. The selected dataset is also imbalanced. Therefore, to increase the efficiency of the system depending on attack types and to decrease missed intrusions and false alarms, the imbalance ratio is reduced by using a synthetic data generation model called Synthetic Minority Oversampling TEchnique (SMOTE). Data generation is performed for minor classes, and their numbers are increased to the average data size via this technique. Experimental results demonstrated that the proposed approach considerably increases the detection rate for rarely encountered intrusions.

show abstract

“…e features pass through several hidden layers and, in the last output layer, the outcome of the neural network is compared with labels attached to the original data to determine whether the network has detected attack types such as DoS, Probe, and U2R. Due to its discriminative power, deep learning approaches have been used by many authors [7,8] for network intrusion detection, and still the area is open for quality research.…”

Section: Deep Learning For Intrusion Detectionmentioning

confidence: 99%

Recurrent Neural Network Model Based on a New Regularization Technique for Real-Time Intrusion Detection in SDN Environments

Albahar

2019

Security and Communication Networks

View full text Add to dashboard Cite

Software-defined networking (SDN) is a promising approach to networking that provides an abstraction layer for the physical network. This technology has the potential to decrease the networking costs and complexity within huge data centers. Although SDN offers flexibility, it has design flaws with regard to network security. To support the ongoing use of SDN, these flaws must be fixed using an integrated approach to improve overall network security. Therefore, in this paper, we propose a recurrent neural network (RNN) model based on a new regularization technique (RNN-SDR). This technique supports intrusion detection within SDNs. The purpose of regularization is to generalize the machine learning model enough for it to be performed optimally. Experiments on the KDD Cup 1999, NSL-KDD, and UNSW-NB15 datasets achieved accuracies of 99.5%, 97.39%, and 99.9%, respectively. The proposed RNN-SDR employs a minimum number of features when compared with other models. In addition, the experiments also validated that the RNN-SDR model does not significantly affect network performance in comparison with other options. Based on the analysis of the results of our experiments, we conclude that the RNN-SDR model is a promising approach for intrusion detection in SDN environments.

show abstract

Deep Learning in Intrusion Detection Systems

Cited by 110 publications

References 13 publications

A Novel PCA-Firefly Based XGBoost Classification Model for Intrusion Detection in Networks Using GPU

A Novel PCA-Firefly Based XGBoost Classification Model for Intrusion Detection in Networks Using GPU

Increasing the Performance of Machine Learning-Based IDSs on an Imbalanced and Up-to-Date Dataset

Recurrent Neural Network Model Based on a New Regularization Technique for Real-Time Intrusion Detection in SDN Environments

Contact Info

Product

Resources

About