Deep Learning for Intrusion Detection Systems (IDSs) in Time Series Data

Future Internet Pub Date : 2024-02-23 DOI:10.3390/fi16030073
Konstantinos Psychogyios, Andreas Papadakis, S. Bourou, Nikolaos P. Nikolaou, Apostolos Maniatis, T. Zahariadis
{"title":"Deep Learning for Intrusion Detection Systems (IDSs) in Time Series Data","authors":"Konstantinos Psychogyios, Andreas Papadakis, S. Bourou, Nikolaos P. Nikolaou, Apostolos Maniatis, T. Zahariadis","doi":"10.3390/fi16030073","DOIUrl":null,"url":null,"abstract":"The advent of computer networks and the internet has drastically altered the means by which we share information and interact with each other. However, this technological advancement has also created opportunities for malevolent behavior, with individuals exploiting vulnerabilities to gain access to confidential data, obstruct activity, etc. To this end, intrusion detection systems (IDSs) are needed to filter malicious traffic and prevent common attacks. In the past, these systems relied on a fixed set of rules or comparisons with previous attacks. However, with the increased availability of computational power and data, machine learning has emerged as a promising solution for this task. While many systems now use this methodology in real-time for a reactive approach to mitigation, we explore the potential of configuring it as a proactive time series prediction. In this work, we delve into this possibility further. More specifically, we convert a classic IDS dataset to a time series format and use predictive models to forecast forthcoming malign packets. We propose a new architecture combining convolutional neural networks, long short-term memory networks, and attention. The findings indicate that our model performs strongly, exhibiting an F1 score and AUC that are within margins of 1% and 3%, respectively, when compared to conventional real-time detection. Also, our architecture achieves an ∼8% F1 score improvement compared to an LSTM (long short-term memory) model.","PeriodicalId":509567,"journal":{"name":"Future Internet","volume":null,"pages":null},"PeriodicalIF":0.0000,"publicationDate":"2024-02-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Future Internet","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.3390/fi16030073","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 0

Abstract

The advent of computer networks and the internet has drastically altered the means by which we share information and interact with each other. However, this technological advancement has also created opportunities for malevolent behavior, with individuals exploiting vulnerabilities to gain access to confidential data, obstruct activity, etc. To this end, intrusion detection systems (IDSs) are needed to filter malicious traffic and prevent common attacks. In the past, these systems relied on a fixed set of rules or comparisons with previous attacks. However, with the increased availability of computational power and data, machine learning has emerged as a promising solution for this task. While many systems now use this methodology in real-time for a reactive approach to mitigation, we explore the potential of configuring it as a proactive time series prediction. In this work, we delve into this possibility further. More specifically, we convert a classic IDS dataset to a time series format and use predictive models to forecast forthcoming malign packets. We propose a new architecture combining convolutional neural networks, long short-term memory networks, and attention. The findings indicate that our model performs strongly, exhibiting an F1 score and AUC that are within margins of 1% and 3%, respectively, when compared to conventional real-time detection. Also, our architecture achieves an ∼8% F1 score improvement compared to an LSTM (long short-term memory) model.
时间序列数据入侵检测系统(IDS)的深度学习
计算机网络和互联网的出现极大地改变了我们分享信息和相互交流的方式。然而,这种技术进步也为恶意行为创造了机会,一些人利用漏洞获取机密数据、阻碍活动等。为此,需要入侵检测系统(IDS)来过滤恶意流量,防止常见攻击。过去,这些系统依赖于一套固定的规则或与以往攻击的比较。然而,随着计算能力和数据可用性的提高,机器学习已成为这项任务的一种有前途的解决方案。目前,许多系统都在实时使用这种方法进行被动式缓解,而我们则在探索将其配置为主动式时间序列预测的潜力。在这项工作中,我们将进一步探讨这种可能性。更具体地说,我们将经典的 IDS 数据集转换为时间序列格式,并使用预测模型来预测即将到来的恶意数据包。我们提出了一种结合卷积神经网络、长短期记忆网络和注意力的新架构。研究结果表明,我们的模型表现强劲,与传统的实时检测相比,F1得分和AUC分别在1%和3%的范围内。此外,与 LSTM(长短期记忆)模型相比,我们的架构在 F1 分数上提高了 8%。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
求助全文
约1分钟内获得全文 求助全文
来源期刊
自引率
0.00%
发文量
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
copy
已复制链接
快去分享给好友吧!
我知道了
右上角分享
点击右上角分享
0
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术官方微信