Abstract:Intrusion Detection Systems (IDS) play a crucial role in safeguarding network security perimeters by monitoring network traffic and system behavior in real time. The advent of deep learning, particularly through the application of Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks, has significantly enhanced IDS's ability to detect network threats by leveraging autonomous learning and generalization capabilities. However, deep learning-based IDSs encounter challenges, including the necessity for extensive data labeling and the computational resources required, which pose obstacles to their widespread adoption and effectiveness. Nonetheless, deep learning-based IDS encounter challenges, including the requirement for extensive labeled datasets and significant computational resources. This paper proposes a novel hybrid IDS framework — HDCBAN that integrates deep convolutional neural networks, bidirectional LSTM networks, and the AlexNet model to efficiently predict and classify malicious network activities. The HDCBAN model employs deep CNNs to capture local features through convolution, bidirectional LSTMs to seize temporal features for enhanced performance and prediction capabilities, and AlexNet to augment classification efficacy through feature extraction. The effectiveness of this hybrid approach was assessed using real-world datasets, including the publicly available CSE-CIC-IDS 2017, CSE-CIC-IDS 2018, and NSL-KDD datasets, with preprocessing to optimize model performance. Experimental results, validated through 10-fold cross-validation, reveal that our model achieves a malicious attack detection rate and accuracy of up to 99.88% for CSE-CIC-IDS and 99.93% for NSL-KDD, thereby outperforming existing models in detection rate, accuracy, and reducing false positives.

HALNet - A Hybrid Deep Learning Model for Encrypted C&C Malware Traffic Detection.

TCMal: A Hybrid Deep Learning Model for Encrypted Malicious Traffic Classification

Encrypted Malicious Traffic Detection Based on Natural Language Processing and Deep Learning

A New Hybrid Approach for C&C Channel Detection

Detecting unknown HTTP-based malicious communication behavior via generated adversarial flows and hierarchical traffic features

ECNet: Robust Malicious Network Traffic Detection With Multi-View Feature and Confidence Mechanism

HDCBAN: Hybrid Neural Network for Network Intrusion Detection System

Cybernet Model: A New Deep Learning Model for Cyber DDoS Attacks Detection and Recognition

Network Anomaly Intrusion Detection Based on Deep Learning Approach

Identification Domain Fronting Traffic for Revealing Obfuscated C2 Communications

Hierarchical Long Short-Term Memory Network for Cyberattack Detection

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

CECoR-Net: A Character-Level Neural Network Model for Web Attack Detection.

AMalNet: A deep learning framework based on graph convolutional networks for malware detection

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

Using a Recurrent Neural Network and Restricted Boltzmann Machines for Malicious Traffic Detection

An Efficient DenseNet-Based Deep Learning Model for Malware Detection

Discovering Command and Control Channels Using Reinforcement Learning

A Hybrid Deep Learning Model for Malicious Behavior Detection

Hybrid Intrusion Detection Model Based on a Designed Autoencoder.

DeepC2: AI-powered Covert Command and Control on OSNs