Cargando…

Network Anomaly Intrusion Detection Based on Deep Learning Approach

The prevalence of internet usage leads to diverse internet traffic, which may contain information about various types of internet attacks. In recent years, many researchers have applied deep learning technology to intrusion detection systems and obtained fairly strong recognition results. However, m...

Descripción completa

Detalles Bibliográficos
Autores principales: Wang, Yung-Chung, Houng, Yi-Chun, Chen, Han-Xuan, Tseng, Shu-Ming
Formato: Online Artículo Texto
Lenguaje:English
Publicado: MDPI 2023
Materias:
Acceso en línea:https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9958558/
https://www.ncbi.nlm.nih.gov/pubmed/36850768
http://dx.doi.org/10.3390/s23042171
_version_ 1784895053331693568
author Wang, Yung-Chung
Houng, Yi-Chun
Chen, Han-Xuan
Tseng, Shu-Ming
author_facet Wang, Yung-Chung
Houng, Yi-Chun
Chen, Han-Xuan
Tseng, Shu-Ming
author_sort Wang, Yung-Chung
collection PubMed
description The prevalence of internet usage leads to diverse internet traffic, which may contain information about various types of internet attacks. In recent years, many researchers have applied deep learning technology to intrusion detection systems and obtained fairly strong recognition results. However, most experiments have used old datasets, so they could not reflect the latest attack information. In this paper, a current state of the CSE-CIC-IDS2018 dataset and standard evaluation metrics has been employed to evaluate the proposed mechanism. After preprocessing the dataset, six models—deep neural network (DNN), convolutional neural network (CNN), recurrent neural network (RNN), long short-term memory (LSTM), CNN + RNN and CNN + LSTM—were constructed to judge whether network traffic comprised a malicious attack. In addition, multi-classification experiments were conducted to sort traffic into benign traffic and six categories of malicious attacks: BruteForce, Denial-of-service (DoS), Web Attacks, Infiltration, Botnet, and Distributed denial-of-service (DDoS). Each model showed a high accuracy in various experiments, and their multi-class classification accuracy were above 98%. Compared with the intrusion detection system (IDS) of other papers, the proposed model effectively improves the detection performance. Moreover, the inference time for the combinations of CNN + RNN and CNN + LSTM is longer than that of the individual DNN, RNN and CNN. Therefore, the DNN, RNN and CNN are better than CNN + RNN and CNN + LSTM for considering the implementation of the algorithm in the IDS device.
format Online
Article
Text
id pubmed-9958558
institution National Center for Biotechnology Information
language English
publishDate 2023
publisher MDPI
record_format MEDLINE/PubMed
spelling pubmed-99585582023-02-26 Network Anomaly Intrusion Detection Based on Deep Learning Approach Wang, Yung-Chung Houng, Yi-Chun Chen, Han-Xuan Tseng, Shu-Ming Sensors (Basel) Article The prevalence of internet usage leads to diverse internet traffic, which may contain information about various types of internet attacks. In recent years, many researchers have applied deep learning technology to intrusion detection systems and obtained fairly strong recognition results. However, most experiments have used old datasets, so they could not reflect the latest attack information. In this paper, a current state of the CSE-CIC-IDS2018 dataset and standard evaluation metrics has been employed to evaluate the proposed mechanism. After preprocessing the dataset, six models—deep neural network (DNN), convolutional neural network (CNN), recurrent neural network (RNN), long short-term memory (LSTM), CNN + RNN and CNN + LSTM—were constructed to judge whether network traffic comprised a malicious attack. In addition, multi-classification experiments were conducted to sort traffic into benign traffic and six categories of malicious attacks: BruteForce, Denial-of-service (DoS), Web Attacks, Infiltration, Botnet, and Distributed denial-of-service (DDoS). Each model showed a high accuracy in various experiments, and their multi-class classification accuracy were above 98%. Compared with the intrusion detection system (IDS) of other papers, the proposed model effectively improves the detection performance. Moreover, the inference time for the combinations of CNN + RNN and CNN + LSTM is longer than that of the individual DNN, RNN and CNN. Therefore, the DNN, RNN and CNN are better than CNN + RNN and CNN + LSTM for considering the implementation of the algorithm in the IDS device. MDPI 2023-02-15 /pmc/articles/PMC9958558/ /pubmed/36850768 http://dx.doi.org/10.3390/s23042171 Text en © 2023 by the authors. https://creativecommons.org/licenses/by/4.0/Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
spellingShingle Article
Wang, Yung-Chung
Houng, Yi-Chun
Chen, Han-Xuan
Tseng, Shu-Ming
Network Anomaly Intrusion Detection Based on Deep Learning Approach
title Network Anomaly Intrusion Detection Based on Deep Learning Approach
title_full Network Anomaly Intrusion Detection Based on Deep Learning Approach
title_fullStr Network Anomaly Intrusion Detection Based on Deep Learning Approach
title_full_unstemmed Network Anomaly Intrusion Detection Based on Deep Learning Approach
title_short Network Anomaly Intrusion Detection Based on Deep Learning Approach
title_sort network anomaly intrusion detection based on deep learning approach
topic Article
url https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9958558/
https://www.ncbi.nlm.nih.gov/pubmed/36850768
http://dx.doi.org/10.3390/s23042171
work_keys_str_mv AT wangyungchung networkanomalyintrusiondetectionbasedondeeplearningapproach
AT houngyichun networkanomalyintrusiondetectionbasedondeeplearningapproach
AT chenhanxuan networkanomalyintrusiondetectionbasedondeeplearningapproach
AT tsengshuming networkanomalyintrusiondetectionbasedondeeplearningapproach