Automatic Intrusion Detection System Using Deep Recurrent Neural Network Paradigm
Article content
Abstract
Network security field had gained research community attention in the last decade due to its growing importance.
This paper addresses directly one vital problem in that field is “Intrusion Detection System” (IDS). As much as many
researchers tackle this problem, many challenges arise while converting this research to reliable automatic system. The
biggest challenge is to make the system works with low false alarm with new unseen threats. In this paper, we address
this challenge by building a descriptive model using different models of deep Recurrent Neural Network (RNNs). (RNN)
models has the ability to generalize the knowledge that can be used to identify seen and unseen threats. This generalization
comes from RNN capabilities to define in its terms the normal behavior and the deviation accepted to be normal. Four
different models of RNN were tested on a benchmark dataset, NSL-KDD, which is a standard test dataset for network
intrusion. The proposed system showed superiority over other previously developed systems according to the standard
measurements: accuracy, recall, precision and f-measure.
Keywords
Intrusion Detection System, Machine Learning, Deep Learning, Long Short Term Memory (LSTM), Recurrent Neural Network (RNN), Bi-Directional Recurrent Neural Network (BRNN)
Downloads
References
H. Abie and I. Balasingham, “Risk-Based Adaptive Security for
Smart IoT in eHealth,” BodyNets’12: Proc. 7th Int. Conf. Body Area Netw., Oslo, NO, Feb. 2012, pp. 269-275.
X. Luo, J. Liu, D. Zhang and X, Chang, “A large-scale web QoS prediction scheme for the Industrial Internet of Things based on akernel machine learning algorithm,” Comput. Netw., vol. 101, pp.81-89, June 2016, doi: 10.1016/j.comnet.2016.01.004.
K. Xu, X. Wang, W. Wei, H. Song, and B. Mao, “Toward software defined smart home,” IEEE Commun. Mag., vol. 54, no. 5, pp.116-122, May 2016, doi: 10.1109/MCOM.2016.7470945.
D. L. Clinefelter and C. B. Aslanian, “Online College Students 2015: Comperhensive Data on Demands and Performance,” The learning House, Inc., Louisville. KY, USA, 2015.
S. Mullainathan and J. Spiess, “Machine Learning: An Applied Econometric Approach,” J. Econ. Persp., vol. 31, no. 2, pp.87-106, Spring 2017.
T. Le, Ji. Kim, Ja. Kim, H. Kim, “An Approach to Build an Efficient Intrusion Detection Classifier,” J. PLT. Tech., vol. 3, no.4,pp.43-52, Dec. 2015.
B. Mukherjee, L. T. Heberlein and K.N. Levitt, “Network intrusion detection,” IEEE. Netw., vol. 8, no. 3, pp. 26-41, May/June 1994, doi: 10.1109/65.283931.
G. Bruneau, “The History and Evolution of Intrusion Detection,”SANS Inst., 2001. [Online]. Available: https://www.sans.org/reading-room/whitepapers/detection/history-evolution-intrusion-detection-344
R. Mitchell and I. R. Chen, “A survey of intrusion detection techniques for cyber-physical systems,” ACM Comput. Surv., vol. 46,no. 4, pp. 1-29, Mar. 2014, doi: 10.1145/2542049.
M. U. Farooq, M. Waseem, A. Khairi and S. Mazhar, “A Critical Analysis on the Security Concerns of Internet of Things (IoT),” Int. J. Comput. Appl., vol. 111, no. 7, Feb. 2015, doi:10.5120/19547-1280.
U. Fiore, F. Palmieri, A. Castiglione and A. D. Santis, “Network anomaly detection with the restricted Boltzmann machine,” Neurocomputing,vol. 122, pp. 13-23, Dec. 2013.
S. Dua and X. Du, Data Mining and Machine Learning in Cybersecurity,1st ed. New York, NY, USA: CRC press, 2016.
M. Esmalifalak, L. Liu, N. Nguyen, R. Zheng and Z. Han, "Detecting Stealthy False Data Injection Using Machine Learning in Smart Grid," IEEE Syst. J., vol. 11, no. 3, pp. 1644-1652, Sept.2017. doi: 10.1109/JSYST.2014.2341597.
H. Debar, M. Dacier and A. Wespi, “A revised taxonomy for intrusion-detection systems,” Ann. Télécommun., vol. 55, no. 7-8,pp. 361-378, Jul. 2000, doi: 10.1007/BF02994844.
J. Shun and H. A. Malki, "Network Intrusion Detection System Using Neural Networks," presented at 2008 Fourth Int. Conf.Nat. Comput., Jinan, pp. 242-246, doi: 10.1109/ICNC.2008.900.
A. Hassan, M. Nasser, S. Ahmed and K. Molla, “Feature Selection for Intrusion Detection Using Random Forest” J. Inf. Secur., vol.7, no. 3, pp. 129-140, Apr. 2016, doi: 10.4236/jis.2016.73009.
L. Deng, “A tutorial survey of architectures, algorithms, and applications for deep learning,” APSIPA Trans. Sig. Inf. Process,vol. 3, p. e2, Jan. 2014, doi: 10.1017/ATSIP.2013.99.
Y. Bengio, A. Courville, and P. Vincent. "Unsupervised feature learning and deep learning: A review and new perspectives,”arXiv:1206.5538v1, [Online]. Available: https://128.84.21.199/abs/1206.5538v1
I. Goodfellow, Y. Bengio and A. Courville, Deep Learning. Cambridge,MA, USA: MIT press, 2016.
D. G. Conorich, “Monitoring Intrusion Detection Systems: From Data to Knowledge” Inf. Syst. Secur., vol. 13, no. 2, pp. 19-30,Dec. 2006, doi: 10.1201/1086/44312.13.2.20040501/81649.4
M. Garuba, C. Liu and D. Fraites, "Intrusion Techniques: Comparative Study of Network Intrusion Detection Systems," in Fifth Int. Conf. Inf. Technol.: New Gen.(itng 2008), Las Vegas, NV,2008, pp. 592-598, doi: 10.1109/ITNG.2008.231
T. Bansode, B.B.Meshram, “Intrusion Prevention System: for End Users,” presented at Int. Conf. Ahmednagar, March 2009.
R. Heady, G. Luger, A. Maccabe and M. Servilla, “The architecture of a network level intrusion detection system,” Univ. New Mexico, Albuquerque, NM, USA, Rep. LA-SUB-93-219, 1990.
R. Bace and P. Mell, “NIST Special Publication on Intrusion Detection Systems,” Booz-Allen And Hamilton Inc, Mclean, VA,Rep. ADA393326, 2001.
B. Shanmugam and N. Idris, “Hybrid Intrusion Detection Systems (HIDS) using Fuzzy Logic,” in Intrusion Detection Systems, P.Skrobanek, Ed, Rijeka, Croatia: InTech, 2011, ch. 8, pp. 135-155.
S. Jonnalagadda and R. Reddy, “A Literature Survey and Comprehensive Study of Intrusion Detection,” Int. J. Comput. Appl.,vol. 81, no. 16, pp. 40-47, Nov. 2013.
J. McHugh, A. Christie and Julia Allen, “Defending Yourself:The Role of Intrusion Detection Systems” IEEE Softw., vol. 17,no. 5, pp. 42-51, Sept.-Oct. 2000, doi: 10.1109/52.877859.
M. Tavallaee, E. Bagheri, W. Lu and A. A. Ghorbani, “A detailed analysis of the KDD CUP 99 data set,” in 2009 IEEE Symp.Comput. Intell. Secur. Def. Appl., Ottawa, ON, 2009, pp. 1-6, doi:10.1109/CISDA.2009.5356528.
N. K. Mittal, “A survey on Wireless Sensor Network for Community Intrusion Detection Systems,” 2016 3rd Int. Conf. Recent Adv. Inf. Technol. (RAIT), Dhanbad, pp. 107-111, doi: 10.1109/RAIT.2016.7507884.
A. G. Tokhtabayev and V. A. Skormin, “Non-Stationary Markov Models and Anomaly Propagation Analysis in IDS,” in Third Int.Symp. Inf. Assurance Secur., Manchester, 2007, pp. 203-208, doi:10.1109/IAS.2007.72.
R. Mandal and S. Yadav, “An Improved Intrusion System Design using Hybrid Classification Technique,” Int. J. Comput. Appl.,vol. 117, no. 10, pp. 20-23, May 2015, doi: 10.5120/20589-3028
S. H. Vasudeo, P. Patil and R. V. Kumar, “IMMIX-intrusion detection and prevention system,” in 2015 Int. Conf. on Smart Technol.Manage. Comput., Commun., Controls, Energy and Mater. (ICSTM),Chennai, pp. 96-101, doi: 10.1109/ICSTM.2015.7225396.
R. Naoum, N. Abid and Z. Al-Sultani, “An Enhanced Resilient Backpropagation Artificial Neural Network for Intrusion Detection System,” Int. J. Comput. Sci. Netw. Secur. (IJCSNS), vol. 12,no. 3, pp. 11-16, Mar. 2012.
H.-s. Chae, B.-o. Jo, S.-H. Choi and T.-k. Park, “Feature Selection for Intrusion Detection using NSL-KDD,” Recent Adv. Comput.Sci., pp. 184-187, Nov. 2013.
S. Thaseen and C. A. Kumar, “An analysis of supervised tree based classifiers for intrusion detection system,” in 2013 Int.Conf. on Pattern Recognit., Inform. and Mobile Eng., Salem, pp.294-299, doi: 10.1109/ICPRIME.2013.6496489.
M. Panda, A. Abraham and M. R. Patra, “Discriminative multinomial Naïve Bayes for network intrusion detection,” in 2010 Sixth Int. Conf. Inf. Assurance Secur., Atlanta, GA, pp. 5-10, doi:10.1109/ISIAS.2010.5604193.
F. E. Heba, A. Darwish, A. E. Hassanien and A. Abraham, “Principle components analysis and Support Vector Machine based Intrusion Detection System,” in 2010 10th Int. Conf. Intell. Syst. Des.Appl., Cairo, pp. 363-367, doi: 10.1109/ISDA.2010.5687239
I. Syarif, A. Prugel-Bennett and G. Wills, “Unsupervised Clustering Approach for Network Anomaly Detection,” in Int. Conf.Netw. Digi. Technol., Berlin, Heidelberg, DE, 2012, pp. 135-145.
J. Kim, J. Kim, H. L. Thi Thu and H. Kim, “Long Short TermMemory Recurrent Neural Network Classifier for Intrusion Detection,”in 2016 Int. Conf. Platform Technol. Service (PlatCon),Jeju, pp. 1-5, doi: 10.1109/PlatCon.2016.7456805.
M. Z. Alom, V. Bontupalli and T. M. Taha, Intrusion detection using deep belief networks," in 2015 Nat. Aerosp. Electron.Conf. (NAECON), Dayton, OH, pp. 339-344, doi: 10.1109/NAECON.2015.7443094.
I. Sustskever, O. Vinyals and Q. Le, “Sequence to Sequence Learning with Neural Networks,” Adv. Neural Info. Process.Syst., pp. 3104-3112, 2014.
F. Gers, N. Schraudolph and J. Schmidhuber, “Learning Precise Timing with LSTM Recurrent Networks,” J. Mach. Learn. Res.,vol. 3, pp. 115-143, 2002.
J. McHugh, “Testing Intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory,” ACM Trans. Info.Syst. Secur., vol. 3, no. 4, pp. 262-294, Nov. 2000.
Article details
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
You must read and accept the copyright terms and conditions(click here for copyright terms).