Abstract:
In the rapidly evolving landscape of information technology, ensuring the security of systems has become increasingly critical. The complexity of cyberattacks has grown alongside the development of information technology, rendering traditional security tools such as signature-based intrusion detection systems (IDS) insufficient for detecting emerging threats.
Traditional IDSs, reliant on static signatures, are limited in their ability to detect unknown or modified attacks. To address this limitation, a new behavior-based approach leveraging techniques like deep learning and signature-based IDS has emerged. This approach aims to enhance performance in detecting new attack types while minimizing false positives and false negatives.
In this study, we evaluated the effectiveness of deep learning approaches for intruder detection by analyzing network flow data, specifically focusing on the CSE-CIC-IDS 2018 dataset. The dataset was chosen for its suitability for real-world scenarios and to promote research on anomaly-based detection through variousmachine-learningg approaches. Our investigation included the impact of using only network flows for raw traffic or deep packet inspection on intrusion detection. The results obtained were very encouraging, demonstrating that a certain amount of attack traffic can be detected through network flow analysis, particularly due to its lower resource consumption and feasibility without running the analysis inline, especially considering the prevalence of encrypted SSH and web traffic. We implemented different approaches using LSTM and performed feature engineering to build the LSTM model, selecting the most efficient activation, optimizer, and loss functions specific to our dataset and prediction goal. The binary classification results showed that the model can detect attack traffic and benign traffic.
Overall, this research delves into the potential of deep learning techniques to enhance intrusion detection systems, particularly in the realm of network flow-based security, marking a significant step towards bolstering the resilience of modern information technology systems.
Keywords: Denial of service attack, Distributed denial of service attack, Intrusion detection
Systems, Deep neural networks, Anomaly detection