Publicação
Deep learning model transposition for network intrusion detection systems
| Resumo: | Companies seek to promote a swift digitalization of their business processes and new disruptive features to gain advantage over their competitors. This often results in wider attack surface that attract attack exploitation. As budgets are thin, one of the most popular security solutions CISOs choose to invest is in NIDS. As anomaly-based NIDSs work over a baseline of normal and expected activity, one of the key areas of development is the training of deep learning classification models robust enough so that, given a different network context, the system is still capable of high-rate accuracy for intrusion detection. In this study, we propose an anomaly-based NIDS using a deep learning stacked-LSTM model with a novel pre-processing technique that gives it context-free features and outperforms most related works, obtaining over 99% accuracy over the CICIDS2017 dataset. It can also be applied to different environments without losing its accuracy since it uses context-free features. Moreover, using synthetic network attacks, our NIDS can detect specific categories of attacks. |
|---|---|
| Autores principais: | Figueiredo, João Pedro da Mota Pereira de |
| Assunto: | Network intrusion detection system (NIDS) Intrusion detection Anomaly detection Deep learning Long short-term memory (LSTM) Sistemas de detecção de intrusão de rede Detecção de intrusão Detecção de anomalias Memória de curto prazo longa |
| Ano: | 2022 |
| País: | Portugal |
| Tipo de documento: | dissertação de mestrado |
| Tipo de acesso: | acesso aberto |
| Instituição associada: | ISCTE |
| Idioma: | inglês |
| Origem: | Repositório ISCTE |
| Resumo: | Companies seek to promote a swift digitalization of their business processes and new disruptive features to gain advantage over their competitors. This often results in wider attack surface that attract attack exploitation. As budgets are thin, one of the most popular security solutions CISOs choose to invest is in NIDS. As anomaly-based NIDSs work over a baseline of normal and expected activity, one of the key areas of development is the training of deep learning classification models robust enough so that, given a different network context, the system is still capable of high-rate accuracy for intrusion detection. In this study, we propose an anomaly-based NIDS using a deep learning stacked-LSTM model with a novel pre-processing technique that gives it context-free features and outperforms most related works, obtaining over 99% accuracy over the CICIDS2017 dataset. It can also be applied to different environments without losing its accuracy since it uses context-free features. Moreover, using synthetic network attacks, our NIDS can detect specific categories of attacks. |
|---|