Abstract:With the increasing dimensionality of network traffic, extracting effective traffic features and improving the identification accuracy of different intrusion traffic have become critical in intrusion detection systems (IDS). However, both unsupervised and semisupervised anomalous traffic detection methods suffer from the drawback of ignoring potential correlations between features, resulting in an analysis that is not an optimal set. Therefore, in order to extract more representative traffic features as well as to improve the accuracy of traffic identification, this paper proposes a feature dimensionality reduction method combining principal component analysis and Hotelling’s T2 and a multilayer convolutional bidirectional long short-term memory (MSC_BiLSTM) classifier model for network traffic intrusion detection. This method reduces the parameters and redundancy of the model by feature extraction and extracts the dependent features between the data by a bidirectional long short-term memory (BiLSTM) network, which fully considers the influence between the before and after features. The network traffic is first characteristically downscaled by principal component analysis (PCA), and then the downscaled principal components are used as input to Hotelling’s T2 to compare the differences between groups. For datasets with outliers, Hotelling’s T2 can help identify the groups where the outliers are located and quantitatively measure the extent of the outliers. Finally, a multilayer convolutional neural network and a BiLSTM network are used to extract the spatial and temporal features of network traffic data. The empirical consequences exhibit that the suggested approach in this manuscript attains superior outcomes in precision, recall and F1-score juxtaposed with the prevailing techniques. The results show that the intrusion detection accuracy, precision, and F1-score of the proposed MSC_BiLSTM model for the CIC-IDS 2017 dataset are 98.71%, 95.97%, and 90.22%.

An Ensemble Approach for Suspicious Traffic Detection from High Recall Network Alerts.

An Intrusion Alarming System Based on Self-Similarity of Network Traffic

An Automated Alert Cross-Verification System with Graph Neural Networks for IDS Events

Research on the detection of abnormal traffic for multi-channel network

An Ensemble Approach for Detecting Anomalous User Behaviors

Processing Intrusion Detection Alerts in Large-scale Network

Alert reduction for network intrusion detection

Discovering Anomaly on the Basis of Flow Estimation of Alert Feature Distribution

DualAC2NN: Revisiting and Alleviating Alert Fatigue from the Detection Perspective

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

Abnormal Traffic Detection: Traffic Feature Extraction and DAE-GAN With Efficient Data Augmentation

Integrating Traffics with Network Device Logs for Anomaly Detection.

Online Network traffic anomaly detection method combining OS-ELM and SADE

Malicious Network Traffic Detection Based on Deep Neural Networks and Association Analysis

MSCA: an Unsupervised Anomaly Detection System for Network Security in Backbone Network.

Network Intrusion Traffic Detection Based on Feature Extraction

A multiscale approach for network intrusion detection based on variance–covariance subspace distance and EQL v2

An Entropy-based Method for Attack Detection in Large Scale Network

Hunter in the Dark: Discover Anomalous Network Activity Using Deep Ensemble Network

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

Reducing False Positives Based on Time Sequence Analysis