Intrusion detection model based on combination of dilated convolution and gated recurrent unit

doi:10.11772/j.issn.1001-9081.2020071082

Abstract

Abstract: Intrusion detection model based on machine learning plays a vital role in the security protection of network environment. Aiming at the problem that the existing network intrusion detection model cannot fully learn the data features of network intrusion, the deep learning theory was applied to intrusion detection, and a deep network model with automatic feature extraction function was proposed. In this model, the dilated convolution was used to increase the receptive field of information and extract high-level features from it, the Gated Recurrent Unit (GRU) model was used to extract long-term dependencies between retained features, then the Deep Neural Network (DNN) was used to fully learn the data features. Compared with the classical machine learning classifier, this model has a higher detection rate. Experiments conducted on the famous KDD CUP99, NSL-KDD and UNSW-NB15 datasets show that the model has the performance better than other classifiers. Specifically, the model has the accuracy of 99.78% on KDD CUP99 dataset, the accuracy of 99.53% on NSL-KDD dataset, and the accuracy of 93.12% on UNSW-NB15 dataset.

Key words: network intrusion detection model, deep learning, gated recurrent unit, dilated convolution, network security

摘要： 基于机器学习的入侵检测模型在网络环境的安全保护中起着至关重要的作用。针对现有的网络入侵检测模型不能够对网络入侵数据特征进行充分学习的问题，将深度学习理论应用于入侵检测，提出了一种具有自动特征提取功能的深度网络模型。在该模型中，使用膨胀卷积来增大对信息的感受野并从中提取高级特征，使用门控循环单元（GRU）模型提取保留特征之间的长期依赖关系，再利用深层神经网络（DNN）对数据特征进行充分学习。与经典的机器学习分类器相比，该模型具有较高的检测率。在著名的KDD CUP99、NSL-KDD和UNSW-NB15数据集上进行的实验表明，该模型具有由于其他分类器的性能。具体来说，该模型在KDD CUP99数据集上的准确率为99.78%，在NSL-KDD数据集上的准确率为99.53%，在UNSW-NB15数据集上的准确率为93.12%。

关键词: 网络入侵检测模型, 深度学习, 门控循环单元, 膨胀卷积, 网络安全

CLC Number:

TP393.08

ZHANG Quanlong, WANG Huaibin. Intrusion detection model based on combination of dilated convolution and gated recurrent unit[J]. Journal of Computer Applications, 2021, 41(5): 1372-1377.

张全龙, 王怀彬. 基于膨胀卷积和门控循环单元组合的入侵检测模型[J]. 计算机应用, 2021, 41(5): 1372-1377.

References

[1] 孔令智. 基于网络异常的入侵检测算法研究[D]. 北京:北京交通大学,2017:15-16. (KONG L Z. Research on intrusion detection algorithm based on network anomaly[D]. Beijing:Beijing Jiaotong University,2017:15-16.)
[2] 沈学利, 覃淑娟. 基于SMOTE和深度信念网络的异常检测[J]. 计算机应用,2018,38(7):1941-1945.(SHEN X L,QIN S J. Anomaly detection based on synthetic minority oversampling technique and deep belief network[J]. Journal of Computer Applications,2018,38(7):1941-1945.)
[3] YIN C,ZHU Y,FEI J,et al. A deep learning approach for intrusion detection using recurrent neural networks[J]. IEEE Access,2017,5:21954-21961.
[4] LIAO Y,VEMURI V R. Use of k-nearest neighbor classifier for intrusion detection[J]. Computers and Security,2002,21(5):439-448.
[5] MUKKAMALA S, JANOSKI G, SUNG A. Intrusion detection using neural networks and support vector machines[C]//Proceedings of the 2002 International Joint Conference on Neural Networks. Piscataway:IEEE,2002:1702-1707.
[6] SALLAY H,AMMAR A,SAAD M B,et al. A real time adaptive intrusion detection alert classifier for high speed networks[C]//Proceedings of the IEEE 12th International Symposium on Network Computing and Applications. Piscataway:IEEE,2013:73-80.
[7] HASAN M A M,NASSER M,PAL B,et al. Support vector machine and random forest modeling for Intrusion Detection System (IDS)[J]. Journal of Intelligent Learning Systems and Applications,2014,6(1):45-52.
[8] JING D,CHEN H B. SVM based network intrusion detection for the UNSW-NB15 dataset[C]//Proceedings of the IEEE 13th International Conference on ASIC. Piscataway:IEEE,2019:1-4.
[9] CHANG H,LEE Y,YOON B,et al. Dynamic near-term traffic flow prediction:system-oriented approach based on past experiences[J]. IET Intelligent Transport Systems,2012,6(3):292-305.
[10] TAHIR H M,HASAN W,SAID A M,et al. Hybrid machine learning technique for intrusion detection system[EB/OL]//Proceedings of the 2015 International Conference on Computing and Informatics.[2020-03-20]. https://www.researchgate.net/publication/283089120_HYBRID_MACHINE_LEARNING_TECHNIQUE_FOR_INTRUSION_DETECTION_SYSTEM.
[11] HU W, GAO J, WANG Y, et al. Online Adaboost-based parameterized methods for dynamic distributed network intrusion detection[J]. IEEE Transactions on Cybernetics,2013,44(1):66-82.
[12] ZHANG J,ZULKERNINE M,HAQUE A. Random-forests-based network intrusion detection systems[J]. IEEE Transactions on Systems,2008,38(5):649-659.
[13] JANARTHANAN T,ZARGARI S. Feature selection in UNSWNB15 and KDDCUP' 99 datasets[C]//Proceedings of the IEEE 26th International Symposium on Industrial Electronics. Piscataway:IEEE,2017:1881-1886.
[14] AL-YASEEN W L,OTHMAN Z A,NAZRI M Z A. Multi-level hybrid support vector machine and extreme learning machine based on modified K-means for intrusion detection system[J]. Expert Systems with Applications,2017,67:296-303.
[15] KRIZHEVSKY A,SUTSKEVER I,HINTON G E. ImageNet classification with deep convolutional neural networks[J]. Communications of the ACM,2017,60(6):84-90.
[16] YAO Y,WEI Y,GAO F,et al. Anomaly intrusion detection approach using hybrid MLP/CNN neural network[C]//Proceedings of the 6th International Conference on Intelligent Systems Design and Applications. Piscataway:IEEE,2006:1095-1102.
[17] HAO Y,SHENG Y,WANG J. Variant gated recurrent units with encoders to preprocess packets for payload-aware intrusion detection[J]. IEEE Access,2019,7:49985-49998.
[18] YANG J B,NGUYEN M N,SAN P P,et al. Deep convolutional neural networks on multichannel time series for human activity recognition[C]//Proceedings of the 24th International Joint Conference on Artificial Intelligence. Palo Alto, CA:AAAI Press,2015:3995-4001.
[19] WANG W,SHENG Y,WANG J,et al. HAST-IDS:learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection[J]. IEEE Access,2018,6:1792-1806.
[20] XU C,SHEN J,DU X,et al. An intrusion detection system using a deep neural network with gated recurrent units[J]. IEEE Access,2018,6:48697-48707.
[21] YU F,KOLTUN V. Multi-scale context aggregation by dilated convolutions[EB/OL].[2020-03-21]. https://arxiv.org/pdf/1511.07122v2.pdf.
[22] PEARLMUTTER B A. Gradient calculations for dynamic recurrent neural networks:a survey[J]. IEEE Transactions on Neural Networks,1995,6(5):1212-1228.
[23] BENGIO Y, SIMARD P, FRASCONI P. Learning long-term dependencies with gradient descent is difficult[J]. IEEE Transactions on Neural Networks,1994,5(2):157-166.
[24] DHANABAL L,SHANTHARAJAH S P. A study on NSL-KDD data set for intrusion detection system based on classification algorithms[J]. International Journal of Advanced Research in Computer and Communication Engineering, 2015, 4(6):446-452.
[25] SHONE N,NGOC T N,PHAI V D,et al. A deep learning approach to network intrusion detection[J]. IEEE Transactions on Emerging Topics in Computational Intelligence,2018,2(1):41-50.
[26] AKYOL A,HACIBEYOĞLU M,KARLIK B. Design of multilevel hybrid classifier with variant feature sets for intrusion detection system[J]. IEICE Transaction on Information and Systems,2016, E99. D (7):1810-1821.
[27] MA T,WANG F,CHENG J,et al. A hybrid spectral clustering and deep neural network ensemble algorithm for intrusion detection in sensor networks[J]. Sensors,2016,16(10):No. 1701.
[28] PARSAEI M R,ROSTAMI S M,JAVIDAN R. A hybrid data mining approach for intrusion detection on imbalanced NSL-KDD data set[J]. International Journal of Advanced Computer Science and Applications,2016,7(6):20-25.
[29] DIRO A A, CHILAMKURTI N. Distributed attack detection scheme using deep learning approach for Internet of Tings[J]. Future Generation Computer Systems,2017,82:761-768.
[30] ZHANG J,LING Y,FU X,et al. Model of the intrusion detection system based on the integration of spatial-temporal features[J]. Computers and Security,2020,89:No. 101681.