DL-IDS: Extracting Features Using CNN-LSTM Hybrid Network for Intrusion Detection System

Sun, Pengfei; Liu, Pengju; Li, Qi; Liu, Chenxi; Lu, Xiangling; Hao, Ruochen; Chen, Jinpeng

doi:10.1155/2020/8890306

Cited by 139 publications

(62 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The lower the imbalance of the dataset is, the higher the measures of the correct detection rate are. Besides, for J48 [9,21] and LSTM [21,28] algorithms, when the dataset changes, the detection results and detection time also change. The J48 algorithm has the advantage of the lowest time for detection and classification due to using only one tree for evaluation.…”

Section: Experimental Results a Experimental Results With Dataset Amentioning

confidence: 99%

“…Bagui et al [13] proposed methods of feature selection using K-means Clustering and Correlation based Feature Selection algorithms. In the study [21], the authors proposed using a deep learning model combining Convolutional Neural Network and long short-term memory network (LSTM) to extract and classify cyber-attacks using the CICIDS2017 dataset. Experimental results show that the classification system gives overall accuracy as 98.67% and the accuracy of each attack type as over 99.50%.…”

Section: The Problem Of Optimizing the Anomaly Detection Feature On The Network Based On The Unsw-nb15 Datasetmentioning

confidence: 99%

“…̅ tested with the number of decision trees used as {10, 40, 60, 80, 100}. Besides, we also conduct experiments to compare the RF algorithm with some algorithms of other studies including decision tree (J48) [9,21] and LSTM [21,28] algorithms. In the study [15], the authors have proven that the KNN and logistic regression algorithms both have less efficiency than the decision tree algorithm, so to see the effectiveness of the RF algorithm, we will only compare it with decision tree and LSTM algorithms…”

Section: ̂ (8)mentioning

confidence: 99%

See 2 more Smart Citations

Optimization of network traffic anomaly detection using machine learning

Dam

Lam

2021

IJECE

View full text Add to dashboard Cite

In this paper, to optimize the process of detecting cyber-attacks, we choose to propose 2 main optimization solutions: Optimizing the detection method and optimizing features. Both of these two optimization solutions are to ensure the aim is to increase accuracy and reduce the time for analysis and detection. Accordingly, for the detection method, we recommend using the Random Forest supervised classification algorithm. The experimental results in section 4.1 have proven that our proposal that use the Random Forest algorithm for abnormal behavior detection is completely correct because the results of this algorithm are much better than some other detection algorithms on all measures. For the feature optimization solution, we propose to use some data dimensional reduction techniques such as information gain, principal component analysis, and correlation coefficient method. The results of the research proposed in our paper have proven that to optimize the cyber-attack detection process, it is not necessary to use advanced algorithms with complex and cumbersome computational requirements, it must depend on the monitoring data for selecting the reasonable feature extraction and optimization algorithm as well as the appropriate attack classification and detection algorithms.

show abstract

Section: Experimental Results a Experimental Results With Dataset Amentioning

confidence: 99%

Section: The Problem Of Optimizing the Anomaly Detection Feature On The Network Based On The Unsw-nb15 Datasetmentioning

confidence: 99%

Section: ̂ (8)mentioning

confidence: 99%

See 1 more Smart Citation

Optimization of network traffic anomaly detection using machine learning

Dam

Lam

2021

IJECE

View full text Add to dashboard Cite

show abstract

“…However, the algorithm still needs to be optimized to further improve the classification accuracy. In [23], a hybrid network feature selection method based on convolutional neural network (CNN) and long and short-term memory network (LSTM) had been applied to IDS. According to the experimental results, the proposed feature selection algorithm achieves better accuracy compared with the CNNonly model and the LSTM-only model.…”

Section: Feature Selection Algorithms In Idsmentioning

confidence: 99%

LNNLS-KH: A Feature Selection Method for Network Intrusion Detection

Xin

Peng

Wei

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

As an important part of intrusion detection, feature selection plays a significant role in improving the performance of intrusion detection. Krill herd (KH) algorithm is an efficient swarm intelligence algorithm with excellent performance in data mining. To solve the problem of low efficiency and high false positive rate in intrusion detection caused by increasing high-dimensional data, an improved krill swarm algorithm based on linear nearest neighbor lasso step (LNNLS-KH) is proposed for feature selection of network intrusion detection. The number of selected features and classification accuracy are introduced into fitness evaluation function of LNNLS-KH algorithm, and the physical diffusion motion of the krill individuals is transformed by a nonlinear method. Meanwhile, the linear nearest neighbor lasso step optimization is performed on the updated krill herd position in order to derive the global optimal solution. Experiments show that the LNNLS-KH algorithm retains 7 features in NSL-KDD dataset and 10.2 features in CICIDS2017 dataset on average, which effectively eliminates redundant features while ensuring high detection accuracy. Compared with the CMPSO, ACO, KH, and IKH algorithms, it reduces features by 44%, 42.86%, 34.88%, and 24.32% in NSL-KDD dataset, and 57.85%, 52.34%, 27.14%, and 25% in CICIDS2017 dataset, respectively. The classification accuracy increased by 10.03% and 5.39%, and the detection rate increased by 8.63% and 5.45%. Time of intrusion detection decreased by 12.41% and 4.03% on average. Furthermore, LNNLS-KH algorithm quickly jumps out of the local optimal solution and shows good performance in the optimal fitness iteration curve, convergence speed, and false positive rate of detection.

show abstract

“…Content may change prior to final publication. features from data, but it lacks the ability to learn contextual information; and on the other hand, LSTM, as a time-recursive neural network, is just suitable for processing sequence information, so in recent years, the combination of CNN and LSTM applied to various types of research has emerged and succeeded [23,24]. Inspired by this, Web2Vec intends to use a hybrid CNN-LSTM scheme for feature extraction.…”

Section: E Feature Extractionmentioning

confidence: 99%