A deep learning method to detect network intrusion through flow‐based features. Issue 3 (7th November 2018)

• Record Type: Journal Article
• Authors: Pektaş, Abdurrahman; Acarman, Tankut; Fung, Carol; François, Jérôme; Cordeiro, Weverton; Zhani, Mohamed Faten
• Is Part Of: International journal of network management. Volume 29:Issue 3(2019)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2018-11-07
• Subjects: Computer networks -- Management -- Periodicals; 004.6
• DOI: 10.1002/nem.2050
• Languages: English
• ISSNs: 1055-7148

Abstract

Summary: In this paper, we present a deep neural network model to enhance the intrusion detection performance. A deep learning architecture combining convolution neural network and long short‐term memory learns spatial‐temporal features of network flows automatically. Flow features are extracted from raw network traffic captures, flows are grouped, and the consecutive N flow records are transformed into a two‐dimensional array like an image. These constructed two‐dimensional feature vectors are normalized and forwarded to the deep learning model. Transformation of flow information assures deep learning in a computationally efficient manner. Overall, convolution neural network learns spatial features, and long short‐term memory learns temporal features from a sequence of network raw data packets. To maximize the detection performance of the deep neural network and to reach at the highest statistical metric values, we apply the tree‐structured Parzen estimator seeking the optimum parameters in the parameter hyper‐plane. Furthermore, we investigate the impact of flow status interval, flow window size, convolution filter size, and long short‐term memory units to the detection performance in terms of level in statistical metric values. The presented flow‐based intrusion method outperforms other publicly available methods, and it detects abnormal traffic with 99.09% accuracy and 0.0227 false alarm rate. Abstract : We present a deep neural network to automatically learn spatial‐temporal features of network flows extracted from raw network captures. We combine the convolution neural network (CNN) and long short‐term memory (LSTM) deep learning architecture in order to enhance the intrusion detection capabilities. Flows are grouped and the consecutive N flow records are transformed into a two‐dimensional array like an image, this procedure assures efficiency in computation. Then, the constructed two‐dimensional feature vectors are forwarded to the deep learning model. CNN learns spatial features and LSTM learns temporal features from a sequence of network packets.