Deep Learning Model Transposition for Network Intrusion Detection Systems

• Autor(a) principal: Figueiredo, João
• Data de Publicação: 2023
• Outros Autores: Serrão, Carlos, Almeida, Ana Maria de
• Tipo de documento: Artigo
• Idioma: eng
• Título da fonte: Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
• Texto Completo: https://hdl.handle.net/10316/114807; https://doi.org/10.3390/electronics12020293
• topic: network intrusion detection system (NIDS); intrusion detection; anomaly detection; deep learning (DL); long short-term memory (LSTM)

Companies seek to promote a swift digitalization of their business processes and new disruptive features to gain an advantage over their competitors. This often results in a wider attack surface that may be exposed to exploitation from adversaries. As budgets are thin, one of the most popular security solutions CISOs choose to invest in is Network-based Intrusion Detection Systems (NIDS). As anomaly-based NIDS work over a baseline of normal and expected activity, one of the key areas of development is the training of deep learning classification models robust enough so that, given a different network context, the system is still capable of high rate accuracy for intrusion detection. In this study, we propose an anomaly-based NIDS using a deep learning stacked-LSTM model with a novel pre-processing technique that gives it context-free features and outperforms most related works, obtaining over 99% accuracy over the CICIDS2017 dataset. This system can also be applied to different environments without losing its accuracy due to its basis on context-free features. Moreover, using synthetic network attacks, it has been shown that this NIDS approach can detect specific categories of attacks.