Deep Learning for Intrusion Detection Systems (IDSs) in Time Series Data

Deep Learning for Intrusion Detection Systems (IDSs) in Time Series Data

23 February 2024 | Konstantinos Psychogios, Andreas Papadakis, Stavroula Bourou, Nikolaos Nikolaou, Apostolos Maniatis, Theodore Zahariadis
This paper presents a deep learning approach for intrusion detection systems (IDSs) using time series data. The authors propose a novel architecture combining convolutional neural networks (CNN), long short-term memory (LSTM) networks, and attention mechanisms to predict malicious packets in network traffic. The model is trained on the UNSW-NB15 dataset, a widely used benchmark for intrusion detection systems. The dataset contains 2.5 million network packets with 49 labels, including 2.2 million benign packets and 321,283 malicious ones. The model converts the dataset into a time series format and uses predictive models to forecast future malicious packets. The proposed architecture achieves an F1 score of 83% for T = 1 and 91% for T = 20, which is comparable to real-time IDS classification. The model outperforms traditional LSTM-based approaches, achieving an 8% improvement in F1 score. The study also compares the proposed method with existing approaches, demonstrating the effectiveness of the time series prediction approach in proactive intrusion detection. The results show that the model can detect malicious packets before they enter the system, enabling proactive security measures. The authors also conduct an ablation study to validate the model's architecture and highlight the importance of attention mechanisms in capturing complex patterns in time series data. The study concludes that the proposed approach offers a more robust and accurate method for intrusion detection compared to traditional real-time systems. The results indicate a trade-off between computational complexity and model accuracy, emphasizing the need for customization based on specific use cases. The study also highlights the benefits of analyzing overall network traffic (network grouping) over specific entity interactions (flow grouping) in detecting malicious activity. The authors suggest future research directions, including testing the model in centralized and federated learning paradigms and validating the approach on additional datasets.This paper presents a deep learning approach for intrusion detection systems (IDSs) using time series data. The authors propose a novel architecture combining convolutional neural networks (CNN), long short-term memory (LSTM) networks, and attention mechanisms to predict malicious packets in network traffic. The model is trained on the UNSW-NB15 dataset, a widely used benchmark for intrusion detection systems. The dataset contains 2.5 million network packets with 49 labels, including 2.2 million benign packets and 321,283 malicious ones. The model converts the dataset into a time series format and uses predictive models to forecast future malicious packets. The proposed architecture achieves an F1 score of 83% for T = 1 and 91% for T = 20, which is comparable to real-time IDS classification. The model outperforms traditional LSTM-based approaches, achieving an 8% improvement in F1 score. The study also compares the proposed method with existing approaches, demonstrating the effectiveness of the time series prediction approach in proactive intrusion detection. The results show that the model can detect malicious packets before they enter the system, enabling proactive security measures. The authors also conduct an ablation study to validate the model's architecture and highlight the importance of attention mechanisms in capturing complex patterns in time series data. The study concludes that the proposed approach offers a more robust and accurate method for intrusion detection compared to traditional real-time systems. The results indicate a trade-off between computational complexity and model accuracy, emphasizing the need for customization based on specific use cases. The study also highlights the benefits of analyzing overall network traffic (network grouping) over specific entity interactions (flow grouping) in detecting malicious activity. The authors suggest future research directions, including testing the model in centralized and federated learning paradigms and validating the approach on additional datasets.
Reach us at info@study.space
[slides and audio] Deep Learning for Intrusion Detection Systems (IDSs) in Time Series Data