High Performance Network Intrusion Detection System Using Two-Stage LSTM and Incremental Created Hybrid Features

Abstract

Currently, most network intrusion detection systems (NIDSs) use information about an entire session to detect intrusion, which has the fatal disadvantage of delaying detection. To solve this problem, studies have been proposed to detect intrusions using only some packets belonging to the session but have limited effectiveness in increasing the detection performance compared to conventional methods. In addition, space complexity is high because all packets used for classification must be stored. Therefore, we propose a novel NIDS that requires low memory storage space and exhibits high detection performance without detection delay. The proposed method does not need to store packets for the current session and uses only some packets, as in conventional methods, but achieves very high detection performance. Through experiments, it was confirmed that the proposed NIDS uses only a small memory of 25.8% on average compared to existing NIDSs by minimizing memory consumption for feature creation, while its intrusion detection performance is equal to or higher than those of existing ones. As a result, this method is expected to significantly help increase network safety by overcoming the disadvantages of machine-learning-based NIDSs using existing sessions and packets.

Application of GA-WELM Model Based on Stratified Cross-Validation in Intrusion Detection

“…Select four existing models [39][40][41][42] as comparison models. In the test, a p < 0.05 was considered to indicate statistical significance.…”

“…Thus, the detection capability of the SCV-GA-WELM was statistically superior to those of the comparison models. 6.20 × 10 −3 two-stage LSTM and DNN [42] 6.21 × 10 −7…”

ELM-KL-LSTM: a robust and general incremental learning method for efficient classification of time series data

“…Among which, for efficient classification of time series data, Malialis, Panayiotou & Polycarpou (2022) proposed an incremental learning method ActiSiamese based on active learning and siamese neural networks which can solve the problem of non-equilibrium appearing to some extent. Based on LSTM and DNN, a new method which can be used for network intrusion detection is proposed in Han & Pak (2023) , greatly reducing detection delay and achieving high detection performance, which is of significant help to improve network security performance. Facing the dynamically changing 3D attitude data, an incremental learning method based on LSTM is proposed for real-time 3D attitude estimation, which solves the uncertainty and unpredictability of dynamic data to a certain extent ( Narkhede et al, 2021 ).…”