Abstract:With the increasing dimensionality of network traffic, extracting effective traffic features and improving the identification accuracy of different intrusion traffic have become critical in intrusion detection systems (IDS). However, both unsupervised and semisupervised anomalous traffic detection methods suffer from the drawback of ignoring potential correlations between features, resulting in an analysis that is not an optimal set. Therefore, in order to extract more representative traffic features as well as to improve the accuracy of traffic identification, this paper proposes a feature dimensionality reduction method combining principal component analysis and Hotelling’s T2 and a multilayer convolutional bidirectional long short-term memory (MSC_BiLSTM) classifier model for network traffic intrusion detection. This method reduces the parameters and redundancy of the model by feature extraction and extracts the dependent features between the data by a bidirectional long short-term memory (BiLSTM) network, which fully considers the influence between the before and after features. The network traffic is first characteristically downscaled by principal component analysis (PCA), and then the downscaled principal components are used as input to Hotelling’s T2 to compare the differences between groups. For datasets with outliers, Hotelling’s T2 can help identify the groups where the outliers are located and quantitatively measure the extent of the outliers. Finally, a multilayer convolutional neural network and a BiLSTM network are used to extract the spatial and temporal features of network traffic data. The empirical consequences exhibit that the suggested approach in this manuscript attains superior outcomes in precision, recall and F1-score juxtaposed with the prevailing techniques. The results show that the intrusion detection accuracy, precision, and F1-score of the proposed MSC_BiLSTM model for the CIC-IDS 2017 dataset are 98.71%, 95.97%, and 90.22%.

Masquerade Intrusion Detection Based on Network Flow Statistical Data

Modeling User Network Behavior Based on Network Packet Sketches for Masquerade Detection

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

A co-occurrence matrix based masquerade detection method in in-vehicle network

Masquerade Detection Based on Shell Commands and High-Order Markov Chain Models

A variable-length model for masquerade detection

Masquerade Intrusion Detection Algonthm Based on Interval Type-2 Fuzzy Set

Intrusion Detection Method Based on RB-SMOTE and Double Attention

AdaBoost-Based Algorithm for Network Intrusion Detection

A Deep Learning Model for Network Intrusion Detection with Imbalanced Data

An Industrial Network Intrusion Detection Algorithm Based on Multifeature Data Clustering Optimization Model

A Network Intrusion Detection Model Based on BiLSTM with Multi-Head Attention Mechanism

Flow-MAE: Leveraging Masked AutoEncoder for Accurate, Efficient and Robust Malicious Traffic Classification

Network Intrusion Traffic Detection Based on Feature Extraction

Multi-datasource machine learning in intrusion detection: Packet flows, system logs and host statistics

Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach

Artificial Immune Detection for Network Intrusion Data Based on Quantitative Matching Method

MASiNet: Network Intrusion Detection for IoT Security Based on Meta-Learning Framework

Exploiting Spatial-Temporal Behavior Patterns for Fraud Detection in Telecom Networks

Modeling program behaviors by hidden Markov models for intrusion detection