An Intrusion Detection Model With Attention and BiLSTM-DNN

Abstract—At present, machine learning and deep learning are often used for network traffic intrusion detection. In order to solve the problem of unfocused feature extraction in these methods and improve the accuracy of network intrusion detection, this paper proposes an intrusion detection model that combines Attention and BiLSTM-DNN(ABD). The model uses Attention to perform preliminary feature extraction on input data, reads the relationship between different features, then uses BiLSTM to extract long-distance dependent features, uses DNN to further extract deep-level features, and finally obtains classification through SoftMax classifier. The comparison experiment uses the NSL_KDD data set, and models such as BiLSTM-DNN, support vector machine, decision tree and random forest are selected as the comparison experiment model. The experimental results show that the accuracy of the ABD is improved by 1.0% and 2.0% on the two-category and five-category tasks, respectively, which verifies the effectiveness of the method.