Host-Based Intrusion Detection Model Using Siamese Network

Abstract

As cyberattacks become more intelligent, the difficulty increases for traditional intrusion detection systems to detect advanced attacks that deviate from previously stored patterns. To solve this problem, a deep learning-based intrusion detection system model has emerged that analyzes intelligent attack patterns through data learning. However, deep learning models have the disadvantage of having to re-learn each time a new cyberattack method emerges. The time required to learn a large amount of data is not efficient. In this paper, an experiment was conducted using the Leipzig Intrusion Detection Data Set (LID-DS), which is a host-based intrusion detection data set released in 2018. In addition, in order to evaluate and improve the performance of the system, a host-based intrusion detection model consisting of pre-processing, vector-toimage processing, training and testing steps is proposed. In the training and testing steps, a Siamese Convolutional Neural Network (Siamese-CNN) is constructed using the few-shot learning method, which shows excellent performance by learning a small amount of data. Siamese-CNN determines whether the attack type is the same based on the similarity score of each cyberattack sample converted to an image. The accuracy was calculated using the few-shot learning technique. The performance of the Vanilla Convolutional Neural Network (Vanilla-CNN) and Siamese-CNN are compared to confirm the performance of Siamese-CNN. As a result of measuring the accuracy, precision, recall, and F1-score indicators, it was confirmed that the recall of the Siamese-CNN model proposed in this study increased by about 6% compared to the Vanilla-CNN model.

FL-MAAE: An Intrusion Detection Method for the Internet of Vehicles Based on Federated Learning and Memory-Augmented Autoencoder

“…Poor detection accuracy and execution efficiency on small samples Park et al [20] Building twin convolutional neural networks using small-sample learning methods to extract time-dependent dynamic features in traffic Relatively low detection performance Zhou et al [21] Proposed an incremental long short-term memory-based method to detect attacks Weak detection of stealth attacks Ashraf et al [22] Detecting attacks based on long short-term memory networks and autoencoders Serial spatio-temporal feature extraction is susceptible to the impact of the previous sub-model Liu et al. [23] Collaborative intrusion detection based on blockchain and federated learning High communication overhead Chen et al [24] Increase the weight of important nodes based on the attention mechanism to reduce the overhead of federated intrusion detection Depends on the consistency and stability of the global model Attota et al [25] Improving learning efficiency for different classes of attacks using multi-view ensemble learning computational and communication overheads impact nodes…”

“…Hu et al [19] implemented a wireless network intrusion detection system using adaptive synthetic sampling and a convolutional neural network implemented by a split convolutional module to increase the diversity of spatial features and reduce the impact of inter-channel information redundancy on the model. Park et al [20] convert network traffic into grayscale maps and build twinned convolutional neural networks based on small sample-learning methods to determine the type of attack based on the similarity scores of attack samples. To capture the timedependent dynamic features in network traffic, Zhou et al [21] proposed an incremental long and short-term memory network intrusion detection method that introduces state changes into LSTM and processes dynamic information in network data by obtaining the state of the LSTM implicit layer.…”

Explainable Artificial Intelligence in CyberSecurity: A Survey

“…Keeping the focus on HIDS in [73], Gas-sais et al propose a framework for intrusion detection in IoT which combines user and kernel space using AI techniques to automatically get devices behavior, process the data into numeric arrays to train several machine learning algorithms, and raise alerts whenever an intrusion is found. In [74] and [75] the authors focus the attention on Cloud Environment by detecting Anomalies while [76] propose a Siamese-CNN to determine the attack type converting it to an image. Analyzing the Network-based approaches, in [77], the authors present a NIDS model that employs a non-symmetric deep AutoEncoder and a Random Forest classifier.…”

Machine Learning-Based Intrusion Detection System: An Experimental Comparison

“…99.16% accuracy is achieved on the UNSW-NB dataset and 99.99% on the CICIDS dataset. Park et al (2021) proposes a technique called HIIDS, which is hybrid intelligent IDS. This technique learns important and most relevant features from the dataset.…”