Abstract:The Intrusion Detection System (IDS) distinguishes the harmful entries from the normal ones in network traffic data and aids in network security. Due to the emergence of new and unknown network-connected devices, a lot of modern systems were penetrated. As a result, it is critical to improve information security and to detect new cyber-attacks exploiting various application protocols such as Hyper Text Transfer Protocol (HTTP) and Domain Name System (DNS). Therefore, this paper introduced an Optimized Bidirectional Convolutional Neural Network and Long-Short term Memory (OBCLSTM) method to detect whether the protocol HTTP and DNS is attacked or not. Initially, the records are fed to data normalization and data encoding. After pre-processing, the vectors are fed to the OBCLSTM model. The Bidirectional Channel Pooling (BiCP) layer is used to learn behavior-based features (which show interactions among hosts based on ports, destinations and behavior) and flow-based features (which identify basic flows, such as IP addresses of source-destination and ports), which improves the accuracy of detecting malicious attacks. In the OBCLSTM model, the best hyper parameter configuration for Convolutional Neural Network (CNN) to learn features is tuned using Enhanced Red Fox Optimization (ERFO). Then, bidirectional long short-term memory (BiLSTM) is used to extract features in the time domain and has the ability to preserve the long-term of the information from historical context, allowing attackers to be detected early before causing widespread damage to networks. Finally, the fully connected layer utilizes these features to classify the network data as attacks (types of attacks) or normal. Tests are conducted on the NSL - KDD99, TUIDS, UNSW-NB15 and BoT-IoT datasets. The proposed OBCLSTM method attains better performance in terms of precision, accuracy, recall, and F-measure.

A novel deep-learning based approach to DNS over HTTPS network traffic detection

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

DePL - Detecting Privacy Leakage in DNS-over-HTTPS Traffic.

Intelligent model for the detection and classification of encrypted network traffic in cloud infrastructure

A Lightweight Double-Stage Scheme to Identify Malicious DNS over HTTPS Traffic Using a Hybrid Learning Approach

DNS covert channel detection method using the LSTM model

E-DoH: Elegantly Detecting the Depths of Open DoH Service on the Internet

Detection of Data Leakage Based on DNS Traffic

DNS Tunneling: A Deep Learning based Lexicographical Detection Approach

FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion

A Practical Machine Learning-Based Framework to Detect DNS Covert Communication in Enterprises

Encrypted DNS --> Privacy? A Traffic Analysis Perspective

Identifying DNS-tunneled traffic with predictive models

A Survey on DNS Encryption: Current Development, Malware Misuse, and Inference Techniques

Detection of Malicious DNS-over-HTTPS Traffic: An Anomaly Detection Approach using Autoencoders

Deepdom: Malicious Domain Detection with Scalable and Heterogeneous Graph Convolutional Networks

Detecting Data Leakage in DNS Traffic Based on Time Series Anomaly Detection.

An Empirical Study of the Cost of DNS-over-HTTPS

HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification

Classification and characterization of encoded traffic in SCADA network using hybrid deep learning scheme

Deep learning method for efficient cloud IDS utilizing combined behavior and flow-based features