Feature extraction using Deep Learning for Intrusion Detection System

Ishaque, Mohammed; Hudec, Ladislav

doi:10.1109/cais.2019.8769473

Cited by 26 publications

(11 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the feature extraction stage, a BiLSTM layer learned the long-term temporal features in the dataset, Nadam optimization was applied to the neural network [ 32 ], a dropout layer alleviated overfitting, and a softmax classifier was used for network attack classification.…”

Section: Network Intrusion Detection Methods Based On Fcwgan and Bilstmmentioning

confidence: 99%

Network Intrusion Detection Method Based on FCWGAN and BiLSTM

Song

et al. 2022

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

Imbalanced datasets greatly affect the analysis capability of intrusion detection models, biasing their classification results toward normal behavior and leading to high false-positive and false-negative rates. To alleviate the impact of class imbalance on the detection accuracy of network intrusion detection models and improve their effectiveness, this paper proposes a method based on a feature selection-conditional Wasserstein generative adversarial network (FCWGAN) and bidirectional long short-term memory network (BiLSTM). The method uses the XGBoost algorithm with Spearman’s correlation coefficient to select the data features, filters out useless and redundant features, and simplifies the data structure. A conditional WGAN (CWGAN) is used to generate a small number of samples in the dataset, add them to the original training set to supplement the dataset samples, and apply BiLSTM to complete the training of the model and realize the classification. In comparative tests based on the NSL-KDD and UNSW-NB15 datasets, the accuracy of the proposed model reached 99.57% and 85.59%, respectively, which is 1.44% and 2.98% higher than that of the same type of CWGAN and deep neural network (CWGAN-DNN) model, respectively.

show abstract

Section: Network Intrusion Detection Methods Based On Fcwgan and Bilstmmentioning

confidence: 99%

Network Intrusion Detection Method Based on FCWGAN and BiLSTM

Song

et al. 2022

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

show abstract

“…Therefore, existing features are combined and used in the proposed system through feature extraction. Many studies have proved that using feature extraction improves intrusion detection performance compared with using all features [31][32][33]. However, the number of features to extract inevitably varies from situation to situation.…”

Section: Hyperparameter Control Systemmentioning

confidence: 99%

An Efficient Hyperparameter Control Method for a Network Intrusion Detection System Based on Proximal Policy Optimization

Han¹,

Kim²,

Kim³

2022

Symmetry

View full text Add to dashboard Cite

The complexity of network intrusion detection systems (IDSs) is increasing due to the continuous increases in network traffic, various attacks and the ever-changing network environment. In addition, network traffic is asymmetric with few attack data, but the attack data are so complex that it is difficult to detect one. Many studies on improving intrusion detection performance using feature engineering have been conducted. These studies work well in the dataset environment; however, it is challenging to cope with a changing network environment. This paper proposes an intrusion detection hyperparameter control system (IDHCS) that controls and trains a deep neural network (DNN) feature extractor and k-means clustering module as a reinforcement learning model based on proximal policy optimization (PPO). An IDHCS controls the DNN feature extractor to extract the most valuable features in the network environment, and identifies intrusion through k-means clustering. Through iterative learning using the PPO-based reinforcement learning model, the system is optimized to improve performance automatically according to the network environment, where the IDHCS is used. Experiments were conducted to evaluate the system performance using the CICIDS2017 and UNSW-NB15 datasets. In CICIDS2017, an F1-score of 0.96552 was achieved and UNSW-NB15 achieved an F1-score of 0.94268. An experiment was conducted by merging the two datasets to build a more extensive and complex test environment. By merging datasets, the attack types in the experiment became more diverse and their patterns became more complex. An F1-score of 0.93567 was achieved in the merged dataset, indicating 97% to 99% performance compared with CICIDS2017 and UNSW-NB15. The results reveal that the proposed IDHCS improved the performance of the IDS by automating learning new types of attacks by managing intrusion detection features regardless of the network environment changes through continuous learning.

show abstract

“…ere was k � 10 folds in the dataset, but this was done by the authors. Ishaque et al's [23] semisupervised learning approach is based on fuzzy and ensemble learning theories. An accuracy rating of 84% was achieved on the KDD test set using the NSL-KDD dataset.…”

Section: Literature Surveymentioning

confidence: 99%

A Novel Intelligent-Based Intrusion Detection System Approach Using Deep Multilayer Classification

Ugendhar

Illuri²,

Vulapula

et al. 2022

Mathematical Problems in Engineering

View full text Add to dashboard Cite

Cybersecurity in information technology (IT) infrastructures is one of the most significant and complex issues of the digital era. Increases in network size and associated data have directly affected technological breakthroughs in the Internet and communication areas. Malware attacks are becoming increasingly sophisticated and hazardous as technology advances, making it difficult to detect an incursion. Detecting and mitigating these threats is a significant issue for standard analytic methods. Furthermore, the attackers use complex processes to remain undetected for an extended period. The changing nature and many cyberattacks require a quick, adaptable, and scalable defense system. For the most part, traditional machine learning-based intrusion detection relies on only one algorithm to identify intrusions, which has a low detection rate and cannot handle large amounts of data. To enhance the performance of intrusion detection systems, a new deep multilayer classification approach is developed. This approach comprises five modules: preprocessing, autoencoding, database, classification, and feedback. The classification module uses an autoencoder to decrease the number of dimensions in a reconstruction feature. Our method was tested against a benchmark dataset, NSL-KDD. Compared to other state-of-the-art intrusion detection systems, our methodology has a 96.7% accuracy.

show abstract

Feature extraction using Deep Learning for Intrusion Detection System

Cited by 26 publications

References 9 publications

Network Intrusion Detection Method Based on FCWGAN and BiLSTM

Network Intrusion Detection Method Based on FCWGAN and BiLSTM

An Efficient Hyperparameter Control Method for a Network Intrusion Detection System Based on Proximal Policy Optimization

A Novel Intelligent-Based Intrusion Detection System Approach Using Deep Multilayer Classification

Contact Info

Product

Resources

About