Abstract:With the increasing dimensionality of network traffic, extracting effective traffic features and improving the identification accuracy of different intrusion traffic have become critical in intrusion detection systems (IDS). However, both unsupervised and semisupervised anomalous traffic detection methods suffer from the drawback of ignoring potential correlations between features, resulting in an analysis that is not an optimal set. Therefore, in order to extract more representative traffic features as well as to improve the accuracy of traffic identification, this paper proposes a feature dimensionality reduction method combining principal component analysis and Hotelling’s T2 and a multilayer convolutional bidirectional long short-term memory (MSC_BiLSTM) classifier model for network traffic intrusion detection. This method reduces the parameters and redundancy of the model by feature extraction and extracts the dependent features between the data by a bidirectional long short-term memory (BiLSTM) network, which fully considers the influence between the before and after features. The network traffic is first characteristically downscaled by principal component analysis (PCA), and then the downscaled principal components are used as input to Hotelling’s T2 to compare the differences between groups. For datasets with outliers, Hotelling’s T2 can help identify the groups where the outliers are located and quantitatively measure the extent of the outliers. Finally, a multilayer convolutional neural network and a BiLSTM network are used to extract the spatial and temporal features of network traffic data. The empirical consequences exhibit that the suggested approach in this manuscript attains superior outcomes in precision, recall and F1-score juxtaposed with the prevailing techniques. The results show that the intrusion detection accuracy, precision, and F1-score of the proposed MSC_BiLSTM model for the CIC-IDS 2017 dataset are 98.71%, 95.97%, and 90.22%.

Implanting Domain Knowledge into Feature Selection for Effective Outlier Detection in Network Traffic Data

Outlier Detection Ensemble with Embedded Feature Selection.

A Novel Feature Selection Methodology Based on Outlier Detection Technologies

A many-objective integrated evolutionary algorithm for feature selection in anomaly detection

Effective End-to-end Unsupervised Outlier Detection Via Inlier Priority of Discriminative Network.

CBFS: A Clustering-Based Feature Selection Mechanism for Network Anomaly Detection

Integration of simulated annealing into pigeon inspired optimizer algorithm for feature selection in network intrusion detection systems

Automated Feature Selection for Anomaly Detection in Network Traffic Data

Learning Automata Based Feature Selection for Network Traffic Intrusion Detection

Network Intrusion Traffic Detection Based on Feature Extraction

DATA MINING IMPLEMENTATION FOR DETECTION OF ANOMALIES IN NETWORK TRAFFIC PACKETS USING OUTLIER DETECTION APPROACH

A neighborhood weighted-based method for the detection of outliers

An Outlier Detection Algorithm Based on Cross-Correlation Analysis for Time Series Dataset

An Effective Feature Selection Algorithm for Machine Learning-based Malicious Traffic Detection

Research on Traffic Incident Detection with Outlier Mining Technology

Multi-task Feature Selection based Anomaly Detection

E3 Outlier: A Self-Supervised Framework for Unsupervised Deep Outlier Detection

Exploring a High-quality Outlying Feature Value Set for Noise-Resilient Outlier Detection in Categorical Data.

AutoOD: Automated Outlier Detection via Curiosity-guided Search and Self-imitation Learning

Anomalous Network Traffic Detection Method Based on an Elevated Harris Hawks Optimization Method and Gated Recurrent Unit Classifier

NDOD: an Efficient Neighboring Dependent Outlier Detector for Bias Distributed Large Datasets