MLIDS22- IDS Design by Applying Hybrid CNN-LSTM model on Mixed-Datasets

Inam Abdullah Abdulmajeed, Idress Mohammed Husien

Abstract


The intrusion detection system (IDS) is an essential part of cyber security which captures and investigates traffic to distinguish between legitimate and malicious activities and determines the type of attack. The selection of the dataset used in training the machine learning based IDS is crucial in ensuring that IDS performs accurately in cyber-attacks classification. When utilizing multiple datasets in the training process, the metrics will relate numerically between the ML algorithm and particular dataset. Previous research concluded a major decline in metrics when using inter-datasets evaluation. This research investigates thoroughly about the use of the most modern and comprehensive IDS datasets CIC-IDS-2017 and CSE-CIC-IDS2018, to design and evaluate machine learning based IDS system using hybrid CNN-LSTM architecture. The new approach followed is to generate a new dataset which is the output of mixing both datasets. The experimental testing showed a superior metrics values yielded when training with the mixture dataset against the use of individual datasets, especially when performing inter-datasets evaluation, which overcomes the generalization problem.

Full Text:

PDF

References


K. Scarfone, P. Mell and others, "Guide to intrusion detection and prevention systems (idps)," NIST special publication, vol. 800, p. 94, 2007.

B. I. A. Barry and H. A. Chan, "Intrusion detection systems," in Handbook of information and communication security, Springer, 2010, p. 193–205.

Z. Ahmad, A. Shahid Khan, C. Wai Shiang, J. Abdullah and F. Ahmad, "Network intrusion detection system: A systematic study of machine learning and deep learning approaches," Transactions on Emerging Telecommunications Technologies, vol. 32, p. e4150, 2021.

M. Rhodes-Ousley, Information Security The Complete Reference, Second Edition, US: McGraw-Hill Osborne Media, 2013, pp. -1.

A. A. Ghorbani, W. Lu and M. Tavallaee, Network intrusion detection and prevention: concepts and techniques, vol. 47, Springer Science & Business Media, 2009.

H. El-Taj, F. Najjar, H. Alsenawi and M. Najjar, "Intrusion detection and prevention response based on signature-based and anomaly-based: Investigation study," International Journal of Computer Science and Information Security, vol. 10, p. 50, 2012.

Z. Inayat, A. Gani, N. B. Anuar, M. K. Khan and S. Anwar, "Intrusion response systems: Foundations, design, and challenges," Journal of Network and Computer Applications, vol. 62, p. 53–74, 2016.

M. Verkerken, L. D’hooge, T. Wauters, B. Volckaert and F. De Turck, "Towards model generalization for intrusion detection: Unsupervised machine learning techniques," Journal of Network and Systems Management, vol. 30, p. 1–25, 2022.

D. Chamou, P. Toupas, E. Ketzaki, S. Papadopoulos, K. M. Giannoutakis, A. Drosou and D. Tzovaras, "Intrusion detection system based on network traffic using deep neural networks," in 2019 IEEE 24th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), 2019.

M. Roopak, G. Y. Tian and J. Chambers, "Deep learning models for cyber security in IoT networks," in 2019 IEEE 9th annual computing and communication workshop and conference (CCWC), 2019.

J. Kim, Y. Shin and E. Choi, "An intrusion detection model based on a convolutional neural network," Journal of Multimedia Information System, vol. 6, p. 165–172, 2019.

P. Sun, P. Liu, Q. Li, C. Liu, X. Lu, R. Hao and J. Chen, "DL-IDS: Extracting features using CNN-LSTM hybrid network for intrusion detection system," Security and communication networks, vol. 2020, 2020.

C.-M. Hsu, M. Z. Azhari, H.-Y. Hsieh, S. W. Prakosa and J.-S. Leu, "Robust network intrusion detection scheme using long-short term memory based convolutional neural networks," Mobile Networks and Applications, vol. 26, p. 1137–1144, 2021.

M. A. Khan, "HCRNNIDS: hybrid convolutional recurrent neural network-based network intrusion detection system," Processes, vol. 9, p. 834, 2021.

T. Thilagam and R. Aruna, "Intrusion detection for network based cloud computing by custom RC-NN and optimization," ICT Express, vol. 7, pp. 512-520, 2021.

G. E. Hinton and R. R. Salakhutdinov, "Reducing the dimensionality of data with neural networks," science, vol. 313, p. 504–507, 2006.

O. Abdeljaber, O. Avci, S. Kiranyaz, M. Gabbouj and D. J. Inman, "Real-time vibration-based structural damage detection using one-dimensional convolutional neural networks," Journal of Sound and Vibration, vol. 388, p. 154–170, 2017.

O. Abdeljaber, O. Avci, M. S. Kiranyaz, B. Boashash, H. Sodano and D. J. Inman, "1-D CNNs for structural damage detection: Verification on a structural health monitoring benchmark data," Neurocomputing, vol. 275, p. 1308–1317, 2018.

S. Kiranyaz, O. Avci, O. Abdeljaber, T. Ince, M. Gabbouj and D. J. Inman, "1D convolutional neural networks and applications: A survey," Mechanical systems and signal processing, vol. 151, p. 107398, 2021.

G. Van Houdt, C. Mosquera and G. Nápoles, "A review on the long short-term memory model," Artificial Intelligence Review, vol. 53, p. 5929–5955, 2020.

R. Yao, N. Wang, Z. Liu, P. Chen and X. Sheng, "Intrusion detection system in the advanced metering infrastructure: a cross-layer feature-fusion CNN-LSTM-based approach," Sensors, vol. 21, p. 626, 2021.

Zhang, Hongpo and Huang, Lulu and Wu, Chase Q and Li, Zhanbo, "An effective convolutional neural network based on SMOTE and Gaussian mixture model for intrusion detection in imbalanced dataset," Computer Networks, vol. 177, p. 107315, 2020.

L. Wang, M. Han, X. Li, N. Zhang and H. Cheng, "Review of classification methods on unbalanced data sets," IEEE Access, vol. 9, p. 64606–64628, 2021.

A. Ampountolas, T. Nyarko Nde, P. Date and C. Constantinescu, "A Machine Learning Approach for Micro-Credit Scoring," Risks, vol. 9, 2021.

F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg and others, "Scikit-learn: Machine learning in Python," the Journal of machine Learning research, vol. 12, p. 2825–2830, 2011.

B. Cao, C. Li, Y. Song, Y. Qin and C. Chen, "Network Intrusion Detection Model Based on CNN and GRU," Applied Sciences, vol. 12, p. 4184, 2022.

I. Guyon and A. Elisseeff, "An introduction to variable and feature selection," Journal of machine learning research, vol. 3, p. 1157–1182, 2003.

A. Jović, K. Brkić and N. Bogunović, "A review of feature selection methods with applications," in 2015 38th international convention on information and communication technology, electronics and microelectronics (MIPRO), 2015.

A. Yulianto, P. Sukarno and N. A. Suwastika, "Improving adaboost-based intrusion detection system (IDS) performance on CIC IDS 2017 dataset," in Journal of Physics: Conference Series, 2019.

A. Ampountolas, T. Nyarko Nde, P. Date and C. Constantinescu, "A machine learning approach for micro-credit scoring," Risks, vol. 9, p. 50, 2021.

S. K. Wagh, V. K. Pachghare and S. R. Kolhe, "Survey on intrusion detection system using machine learning techniques," International Journal of Computer Applications, vol. 78, 2013.

M. Pawlicki, M. Choraś, R. Kozik and W. Hołubowicz, "On the impact of network data balancing in cybersecurity applications," in International Conference on Computational Science, 2020.

C. Liu, Z. Gu and J. Wang, "A hybrid intrusion detection system based on scalable K-Means+ random forest and deep learning," IEEE Access, vol. 9, p. 75729–75740, 2021.

S. Kiranyaz, A. Gastli, L. Ben-Brahim, N. Al-Emadi and M. Gabbouj, "Real-time fault detection and identification for MMC using 1-D convolutional neural networks," IEEE Transactions on Industrial Electronics, vol. 66, p. 8760–8771, 2018.

S. Kiranyaz, T. Ince and M. Gabbouj, "Personalized monitoring and advance warning system for cardiac arrhythmias," Scientific reports, vol. 7, p. 1–8, 2017.

S. Kiranyaz, T. Ince, R. Hamila and M. Gabbouj, "Convolutional neural networks for patient-specific ECG classification," in 2015 37th Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC), 2015.

Y.-B. Ho, W.-S. Yap and K.-C. Khor, "The Effect of Sampling Methods on the CICIDS2017 Network Intrusion Data Set," in IT Convergence and Security, Springer, 2021, p. 33–41.

K. Fotiadou, T.-H. Velivassaki, A. Voulkidis, D. Skias, S. Tsekeridou and T. Zahariadis, "Network traffic anomaly detection via deep learning," Information, vol. 12, p. 215, 2021.

B. I. Farhan and A. D. Jasim, "Performance analysis of intrusion detection for deep learning model based on CSE-CIC-IDS2018 dataset," Indonesian Journal of Electrical Engineering and Computer Science, vol. 26, p. 1165–1172, 2022.

M. Azizjon, A. Jumabek and W. Kim, "1D CNN based network intrusion detection with normalization on imbalanced data," in 2020 International Conference on Artificial Intelligence in Information and Communication (ICAIIC), 2020.

O. Avci, O. Abdeljaber, S. Kiranyaz, M. Hussein and D. J. Inman, "Wireless and real-time structural damage detection: A novel decentralized method for wireless sensor networks," Journal of Sound and Vibration, vol. 424, p. 158–172, 2018.

O. Avci, O. Abdeljaber, S. Kiranyaz, B. Boashash, H. Sodano and D. J. Inman, "Efficiency validation of one dimensional convolutional neural networks for structural damage detection using a SHM benchmark data," in Proc. 25th Int. Conf. Sound Vib.(ICSV), 2018.

A. M. Al Tobi and I. Duncan, "KDD 1999 generation faults: A review and analysis," Journal of Cyber Security Technology, vol. 2, p. 164–200, 2018.

M. Ahsan and K. E. Nygard, "Convolutional Neural Networks with LSTM for Intrusion Detection.," in CATA, 2020.

A. A. Abdulrahman and M. K. Ibrahem, "Toward constructing a balanced intrusion detection dataset based on CICIDS2017," Samarra Journal of Pure and Applied Science, vol. 2, p. 132–142, 2020.




DOI: https://doi.org/10.31449/inf.v46i8.4348

Creative Commons License
This work is licensed under a Creative Commons Attribution 3.0 License.