Early Detection of Network Intrusions Using a GAN-Based One-Class Classifier

Abstract

Early detection of network intrusions is a very important factor in network security. However, most studies of network intrusion detection systems utilize features for full sessions, making it difficult to detect intrusions before a session ends. To solve this problem, the proposed method uses packet data for features to determine if packets are malicious traffic. Such an approach inevitably increases the probability of falsely detecting normal packets as an intrusion or an intrusion as normal traffic for the initial session. As a solution, the proposed method learns the patterns of packets that are unhelpful in order to classify network intrusions and benign sessions. To this end, a new training dataset for Generative Adversarial Network (GAN) is created using misclassified data from an original training dataset by the LSTM-DNN model trained using the original one. The GAN trained with this dataset has ability to determine whether the currently received packet can be accurately classified in the LSTM-DNN. If the GAN determines that the packet cannot be classified correctly, the detection process is canceled and will be tried again when the next packet is received. Meticulously designed classification algorithm based on LSTM-DNN and validation model using GAN enable the proposed algorithm to accurately perform network intrusion detection in real time without session termination or delay time for collecting a certain number of packets. Various experiments confirm that the proposed method can detect intrusions very early (before the end of the session) while maintaining detection performance at a level similar to that of the existing methods.

SecureNet: Network Intrusion Detection using Machine Learning and Deep Learning Techniques

“…Long Short-Term Memory (LSTM), a specialized Recurrent Neural Network (RNN) variant, is harnessed to capture temporal dependencies within network data, making it well-suited for sequential pattern recognition [10]. Our research demonstrates the superior accuracy of LSTM, reaching 97%, showcasing its efficacy in detecting nuanced and time-dependent network intrusion behaviors.…”

Network Intrusion Detection Based on Feature Image and Deformable Vision Transformer Classification

“…However, this method is based on specific datasets and has not been further tested and validated, which may not be suitable for real-world scenarios or other datasets. Kim et al [29] proposed a method for early detection of network intrusion using a type of classifier based on Generative Adversarial Networks (GAN). This method takes the packet data as the input feature and judges whether the data packet is malicious traffic through the model, enabling realtime and accurate intrusion detection without the delay time of session termination or collecting a certain number of packets.…”

Multi-Valued Neutrosophic Convolutional LSTM for Intrusion Detection

“…In order to differentiate between malicious and safe sessions on a network, one-class classifier with the support of GAN [15] A DNN model was suggested for RT-IDS [16]. The needs of a real-time IDS can be met by this paradigm.…”

“…Records of both innocuous traffic and nine types of assaults (including Fuzzers, analysis, Backdoor, DoS, 160 Exploits, etc.) are The proposed MV-ConvLSTM and other algorithms such as Conv-LSTM [11], SDAE-ELM [14], GAN-DNN-LSTM [15], CNN RSA [10] and CNN-LSTM [18] are developed by Python 3.7.8 for same three intrusion datasets. The evolution metrics like accuracy, precision and recall are evaluated.…”