GRU‐GBM: A combined intrusion detection model using LightGBM and gated recurrent unit

Abstract

Due to the increasing sophistication of cyber‐attacks, intrusion detection systems need to be improved constantly. Each machine learning classifier has different advantages against intrusion detection and combining the advantages of different classifiers increases detection rates. In this study, we combine a machine learning classifier with a deep learning model to propose a new approach called GRU‐GBM. The LightGBM gradient boosting machine framework is used for feature selection, and each feature in the dataset is evaluated by a second LightGBM classifier to determine the optimal feature set using a novel threshold‐based approach. After the selection of the feature set, a gated recurrent unit is used for attack detection by a recurrent neural network model. Besides, different training/testing ratios (60/40–70/30) are chosen for comparison of GRU‐GBM accuracy. The proposed combined model achieved 76.61% and 93.65% overall accuracy in multi‐class experiments conducted with the UNSW‐NB15 and LITNET‐2020 datasets, respectively. Lastly, the GRU‐GBM model is compared to other machine learning models. The overall accuracy result is tested with a non‐parametric Friedman test to determine the significance of the results. The test result shows that there is enough evidence that the accuracy of the GRU‐GBM classifier is statistically significant.

A Comprehensive Review of Machine Learning Approaches for Anomaly Detection in Smart Homes: Experimental Analysis and Future Directions

“…The Light Gradient Boosting Machine (LGBM) classifier is a fast, efficient, and highperforming gradient boosting system for machine learning and statistical modeling. Because of its histogram-based learning method, the LGBM is well-suited for training on huge datasets because it can more quickly calculate gradients by grouping data points into histogram bins [48]. Using a structure very similar to classic gradient boosting, it gradually adds decision trees to enhance prediction precision.…”

“…The reset gate determines which information from the prior hidden state should be reset or forgotten, while the update gate controls the extent the new input should impact the updating process of the hidden state. By combining these gates, GRU cells can selectively update their hidden states, allowing them to capture long-term dependencies in sequential data [48]. Figure 2 presents the base structure of the GRU.…”