Detection of Malicious Activities and Connections for Network Security using Deep Learning

Abstract

Computer attacks are growing in both number and diversity as a result of the ongoing growth of the Internet: ransomware is more prevalent than ever before, and zero-day vulnerabilities are gaining so much importance that they are attracting media attention. Antivirus software and firewalls are no longer sufficient to safeguard a company's network; instead, many layers of security are required. One of the most important layers, an intrusion detection system, is designed to protect its target from any potential attack by continually monitoring the system (IDS). IDSs may currently be classified into two basic categories: anomaly detection and signature-based detection. For signature-based detection, the IDS compares the data it is watching to known attack patterns. Although this method has gained popularity because to tools like Snort, it has a serious drawback: it can only detect known threats that have already been described in a database. On the other hand, anomaly detection builds a model of the system's typical behaviour before searching for anomalies in the observed data. As a consequence, while it often generates a great deal of false alarms, this approach may reveal undiscovered risks.