Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

NIDS Neural Networks Using Sliding Time Window Data Processing with Trainable Activations and its Generalization Capability

Anton Raskovalov, Nikita Gabdullin, Ilya Androsov

Abstract

This paper presents neural networks for network intrusion detection systems (NIDS), that operate on flow data preprocessed with a time window. It requires only eleven features which do not rely on deep packet inspection and can be found in most NIDS datasets and easily obtained from conventional flow collectors. The time window aggregates information with respect to hosts facilitating the identification of flow signatures that are missed by other aggregation methods. Several network architectures are studied and the use of Kolmogorov-Arnold Network (KAN)-inspired trainable activation functions that help to achieve higher accuracy with simpler network structure is proposed. The reported training accuracy exceeds 99% for the proposed method with as little as twenty neural network input features. This work also studies the generalization capability of NIDS, a crucial aspect that has not been adequately addressed in the previous studies. The generalization experiments are conducted using CICIDS2017 dataset and a custom dataset collected as part of this study. It is shown that the performance metrics decline significantly when changing datasets, and the reduction in performance metrics can be attributed to the difference in signatures of the same type flows in different datasets, which in turn can be attributed to the differences between the underlying networks. It is shown that the generalization accuracy of some neural networks can be very unstable and sensitive to random initialization parameters, and neural networks with fewer parameters and well-tuned activations are more stable and achieve higher accuracy.

NIDS Neural Networks Using Sliding Time Window Data Processing with Trainable Activations and its Generalization Capability

Abstract

This paper presents neural networks for network intrusion detection systems (NIDS), that operate on flow data preprocessed with a time window. It requires only eleven features which do not rely on deep packet inspection and can be found in most NIDS datasets and easily obtained from conventional flow collectors. The time window aggregates information with respect to hosts facilitating the identification of flow signatures that are missed by other aggregation methods. Several network architectures are studied and the use of Kolmogorov-Arnold Network (KAN)-inspired trainable activation functions that help to achieve higher accuracy with simpler network structure is proposed. The reported training accuracy exceeds 99% for the proposed method with as little as twenty neural network input features. This work also studies the generalization capability of NIDS, a crucial aspect that has not been adequately addressed in the previous studies. The generalization experiments are conducted using CICIDS2017 dataset and a custom dataset collected as part of this study. It is shown that the performance metrics decline significantly when changing datasets, and the reduction in performance metrics can be attributed to the difference in signatures of the same type flows in different datasets, which in turn can be attributed to the differences between the underlying networks. It is shown that the generalization accuracy of some neural networks can be very unstable and sensitive to random initialization parameters, and neural networks with fewer parameters and well-tuned activations are more stable and achieve higher accuracy.

Paper Structure

This paper contains 15 sections, 4 equations, 3 figures, 9 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. NIDS datasets
  3. CICIDS2017 dataset
  4. Own Dataset
  5. Methodology
  6. Time-Window Processing of Datasets
  7. Feature Engineering
  8. Feature normalization with trainable activation functions
  9. Neural Network Architectures
  10. Training and verification details
  11. Results and Discussion
  12. Neural network generalization
  13. Test of catastrophic forgetfulness and the ability to retrain
  14. Confusion matrix, f1-score
  15. Conclusions

Figures (3)

  • Figure 1: Choosing quantitative host data depending the flow protocol.
  • Figure 2: Applying different neural networks depending on flow's protocol. Since for every flow only one protocol flag is non-zero, only corresponding protocol's neural network output is non-zero, too.
  • Figure 3: Visualization of value distribution for some data fields in datasets (CDSR and ODS): min vs max numbers of transferred bytes (upper row), and min vs max count of ports per counts of flows between hosts (bottom row).