Abstract:With the increasing dimensionality of network traffic, extracting effective traffic features and improving the identification accuracy of different intrusion traffic have become critical in intrusion detection systems (IDS). However, both unsupervised and semisupervised anomalous traffic detection methods suffer from the drawback of ignoring potential correlations between features, resulting in an analysis that is not an optimal set. Therefore, in order to extract more representative traffic features as well as to improve the accuracy of traffic identification, this paper proposes a feature dimensionality reduction method combining principal component analysis and Hotelling’s T2 and a multilayer convolutional bidirectional long short-term memory (MSC_BiLSTM) classifier model for network traffic intrusion detection. This method reduces the parameters and redundancy of the model by feature extraction and extracts the dependent features between the data by a bidirectional long short-term memory (BiLSTM) network, which fully considers the influence between the before and after features. The network traffic is first characteristically downscaled by principal component analysis (PCA), and then the downscaled principal components are used as input to Hotelling’s T2 to compare the differences between groups. For datasets with outliers, Hotelling’s T2 can help identify the groups where the outliers are located and quantitatively measure the extent of the outliers. Finally, a multilayer convolutional neural network and a BiLSTM network are used to extract the spatial and temporal features of network traffic data. The empirical consequences exhibit that the suggested approach in this manuscript attains superior outcomes in precision, recall and F1-score juxtaposed with the prevailing techniques. The results show that the intrusion detection accuracy, precision, and F1-score of the proposed MSC_BiLSTM model for the CIC-IDS 2017 dataset are 98.71%, 95.97%, and 90.22%.

A Feature Extraction Method of Network Traffic for Time-Frequency Synchronization Applications

An Intrusion Alarming System Based on Self-Similarity of Network Traffic

Comparative Study On Feature Extraction Of Mass Traffic Data Using Multiple Methods

Dynamic Feature Analysis and Measurement for Large-Scale Network Traffic Monitoring

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy.

Network Traffic Anomaly Detection Method Based on Multi scale Residual Feature

Spatial-Temporal Congestion Identification Based on Time Series Similarity Considering Missing Data

Network Intrusion Traffic Detection Based on Feature Extraction

A new connection degree calculation and measurement method for large scale network monitoring.

Monitoring Abnormal Network Traffic Based on Blind Source Separation Approach

Dynamic features measurement and analysis for large-scale networks

A nonstationary traffic train model for fine scale inference from coarse scale counts

Monitoring abnormal traffic flows based on independent component analysis

An early stage convolutional feature extracting method using for mining traffic detection

Network Traffic Classification Algorithm Based on Spectral Clustering

Video traffic identification with novel feature extraction and selection method

Feature Extraction for Novelty Detection in Network Traffic

MBST: Detecting Packet-Level Traffic Anomalies by Feature Stability

Recurrence Based Nonlinear Analysis for Network Application Traffic

Discovering Urban Spatio-temporal Structure from Time-Evolving Traffic Networks

Mining for Similarities in Urban Traffic Flow Using Wavelets