Deep Reinforcement Learning based Intrusion Detection System for Cloud Infrastructure

Sethi, Kamalakanta; Kumar, Rahul; Prajapati, Nishant; Bera, Padmalochan

doi:10.1109/comsnets48256.2020.9027452

Cited by 50 publications

(21 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…e results offered for comparison with the proposed system in [8,[12][13][14][15][16][17][18][19] are obtained using the partial datasets which are shown in Table 1. However, other results in [7,[9][10][11] are obtained using the full datasets, which are 2,540,044 records including training sets and testing sets [28].…”

Section: Discussionmentioning

confidence: 99%

See 1 more Smart Citation

Improving the Performance of Machine Learning‐Based Network Intrusion Detection Systems on the UNSW‐NB15 Dataset

Moualla

Khorzom

Jafar

2021

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

Networks are exposed to an increasing number of cyberattacks due to their vulnerabilities. So, cybersecurity strives to make networks as safe as possible, by introducing defense systems to detect any suspicious activities. However, firewalls and classical intrusion detection systems (IDSs) suffer from continuous updating of their defined databases to detect threats. The new directions of the IDSs aim to leverage the machine learning models to design more robust systems with higher detection rates and lower false alarm rates. This research presents a novel network IDS, which plays an important role in network security and faces the current cyberattacks on networks using the UNSW-NB15 dataset benchmark. Our proposed system is a dynamically scalable multiclass machine learning-based network IDS. It consists of several stages based on supervised machine learning. It starts with the Synthetic Minority Oversampling Technique (SMOTE) method to solve the imbalanced classes problem in the dataset and then selects the important features for each class existing in the dataset by the Gini Impurity criterion using the Extremely Randomized Trees Classifier (Extra Trees Classifier). After that, a pretrained extreme learning machine (ELM) model is responsible for detecting the attacks separately, “One-Versus-All” as a binary classifier for each of them. Finally, the ELM classifier outputs become the inputs to a fully connected layer in order to learn from all their combinations, followed by a logistic regression layer to make soft decisions for all classes. Results show that our proposed system performs better than related works in terms of accuracy, false alarm rate, Receiver Operating Characteristic (ROC), and Precision-Recall Curves (PRCs).

show abstract

Section: Discussionmentioning

confidence: 99%

“…In [19], they introduced their IDS for the cloud environment, using Chi-square as a feature selection method and deep reinforcement learning as a classification method. ROC curves showed accuracies, FPR, and TPR for each class.…”

Section: Literature Reviewmentioning

confidence: 99%

Improving the Performance of Machine Learning‐Based Network Intrusion Detection Systems on the UNSW‐NB15 Dataset

Moualla

Khorzom

Jafar

2021

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

show abstract

“…For instance, the authors in [131] demonstrate that deep RL models using deep Q-network (DQN), and double deep Q-network (DDQN) give significant intrusion detection results comparing with traditional machine learning models. Similarly, a deep RL-based adaptive intrusion detection framework based on deep-Q-network (DQN) for cloud infrastructure has been presented in [132], where they experimentally reported higher accuracy and low false-positive rates to detect and identify new and complex attacks.…”

Section: Deep Reinforcement Learning (Drl or Deep Rl)mentioning

confidence: 99%

“…Langin et al [84], Le et al [86] , Malondkar et al [85] Auto Encoder (AE) feature learning model, insider threat detection, malware detection, intrusion detection system Yousefi et al [92], Liu et al [93], Wang et al [94], Yan et al [95] Restricted Boltzmann Machine (RBM) network anomaly detection, DoS attack detection, intrusion detection Fiore et al [99], Imamverdiyev et al [100], Mayuranathan et al [125], Alom et al [126] Deep Belief Networks (DBN) intrusion detection system and optimization, phishing detection, malware detection Salama et al [104], Qu et al [105], Wei et al [103], Yi et al [127], Arshey et al [128], Saif et al [129], Hou et al [130] Generative Adversarial Network (GAN) zero-day malware detection, botnet detection, intrusion detection systems Kim et al [108], Li et al [110], Yin et al [109], Merino et al [111] Deep Transfer Learning (DTL or Deep TL) intrusion detection system, detecting unknown network attacks, malware detection, malicious software classification Wu et al [114], Zhao et al [117], Gao et al [118], Rezende et al [119] Deep Reinforcement Learning (DRL or deep RL) intrusion detection system, malware detection, Security and Privacy Lopez et al [131], Sethi et al [132], Fang et al [133], Shakeel et al [134] the quality of the security data and the performance of the learning algorithms.…”

Section: Cybersecurity Tasksmentioning

confidence: 99%

Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective

Sarker

2021

SN COMPUT. SCI.

132

View full text Add to dashboard Cite

Deep learning, which is originated from an artificial neural network (ANN), is one of the major technologies of today's smart cybersecurity systems or policies to function in an intelligent manner. Popular deep learning techniques, such as multi-layer perceptron, convolutional neural network, recurrent neural network or long short-term memory, self-organizing map, autoencoder, restricted Boltzmann machine, deep belief networks, generative adversarial network, deep transfer learning, as well as deep reinforcement learning, or their ensembles and hybrid approaches can be used to intelligently tackle the diverse cybersecurity issues. In this paper, we aim to present a comprehensive overview from the perspective of these neural networks and deep learning techniques according to today's diverse needs. We also discuss the applicability of these techniques in various cybersecurity tasks such as intrusion detection, identification of malware or botnets, phishing, predicting cyberattacks, e.g. denial of service, fraud detection or cyberanomalies, etc. Finally, we highlight several research issues and future directions within the scope of our study in the field. Overall, the ultimate goal of this paper is to serve as a reference point and guidelines for the academia and professionals in the cyber industries, especially from the deep learning point of view.

show abstract

“…a probabilistic generative model with multiple RBMs the ability to encode richer and higher order network structures and can work in either an unsupervised or a supervised setting can be used in a large number of high-dimensional data applications follow the way how humans learn from experience combines reinforcement learning (RL) algorithms like Q-learning and deep learning can be used to solve very complex problems that cannot be solved by conventional techniques Preprints (www.preprints.org) | NOT PEER-REVIEWED | Posted: 16 February 2021 doi:10.20944/preprints202102.0340.v1 [113] and Double Deep Q-Network (DDQN) give significant intrusion detection results comparing with traditional machine learning models. Similarly, a deep RL based adaptive intrusion detection framework based on Deep-Q-Network (DQN) for cloud infrastructure has been presented in [112], where they experimentally reported higher accuracy and low false-positive rates to detect and identify new and complex attacks.…”

Section: Deep Belief Network (Dbn)mentioning

confidence: 99%

Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective

Sarker¹

2021

Preprint

View full text Add to dashboard Cite

Deep learning (DL), which is originated from an artificial neural network (ANN), is one of the major technologies of today's smart cybersecurity systems or policies to function in an intelligent manner. Popular deep learning techniques, such as Multi-layer Perceptron (MLP), Convolutional Neural Network (CNN or ConvNet), Recurrent Neural Network (RNN) or Long Short-Term Memory (LSTM), Self-organizing Map (SOM), Auto-Encoder (AE), Restricted Boltzmann Machine (RBM), Deep Belief Networks (DBN), Generative Adversarial Network (GAN), Deep Transfer Learning (DTL or Deep TL), Deep Reinforcement Learning (DRL or Deep RL), or their ensembles and hybrid approaches can be used to intelligently tackle the diverse cybersecurity issues. In this paper, we aim to present a comprehensive overview from the perspective of these neural networks and deep learning techniques according to today's diverse needs. We also discuss the applicability of these techniques in various cybersecurity tasks such as intrusion detection, identification of malware or botnets, phishing, predicting cyber-attacks, e.g. denial of service (DoS), fraud detection or cyber-anomalies, etc. Finally, we highlight several research issues and future directions within the scope of our study in the field. Overall, the ultimate goal of this paper is to serve as a reference point and guidelines for the academia and professionals in the cyber industries, especially from the deep learning point of view.

show abstract

Deep Reinforcement Learning based Intrusion Detection System for Cloud Infrastructure

Cited by 50 publications

References 10 publications

Improving the Performance of Machine Learning‐Based Network Intrusion Detection Systems on the UNSW‐NB15 Dataset

Improving the Performance of Machine Learning‐Based Network Intrusion Detection Systems on the UNSW‐NB15 Dataset

Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective

Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective

Contact Info

Product

Resources

About