Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SCGNet-Stacked Convolution with Gated Recurrent Unit Network for Cyber Network Intrusion Detection and Intrusion Type Classification

Rajana Akter, Shahnure Rabib, Rahul Deb Mohalder, Laboni Paul, Ferdous Bin Ali

TL;DR

The SCGNet (Stacked Convolution with Gated Recurrent Unit Network) is a novel deep learning architecture that is proposed in this study and exhibits promising results on the NSL-KDD dataset in both task, network attack detection, and attack type classification.

Abstract

Intrusion detection system (IDS) is a piece of hardware or software that looks for malicious activity or policy violations in a network. It looks for malicious activity or security flaws on a network or system. IDS protects hosts or networks by looking for indications of known attacks or deviations from normal behavior (Network-based intrusion detection system, or NIDS for short). Due to the rapidly increasing amount of network data, traditional intrusion detection systems (IDSs) are far from being able to quickly and efficiently identify complex and varied network attacks, especially those linked to low-frequency attacks. The SCGNet (Stacked Convolution with Gated Recurrent Unit Network) is a novel deep learning architecture that we propose in this study. It exhibits promising results on the NSL-KDD dataset in both task, network attack detection, and attack type classification with 99.76% and 98.92% accuracy, respectively. We have also introduced a general data preprocessing pipeline that is easily applicable to other similar datasets. We have also experimented with conventional machine-learning techniques to evaluate the performance of the data processing pipeline.

SCGNet-Stacked Convolution with Gated Recurrent Unit Network for Cyber Network Intrusion Detection and Intrusion Type Classification

TL;DR

The SCGNet (Stacked Convolution with Gated Recurrent Unit Network) is a novel deep learning architecture that is proposed in this study and exhibits promising results on the NSL-KDD dataset in both task, network attack detection, and attack type classification.

Abstract

Intrusion detection system (IDS) is a piece of hardware or software that looks for malicious activity or policy violations in a network. It looks for malicious activity or security flaws on a network or system. IDS protects hosts or networks by looking for indications of known attacks or deviations from normal behavior (Network-based intrusion detection system, or NIDS for short). Due to the rapidly increasing amount of network data, traditional intrusion detection systems (IDSs) are far from being able to quickly and efficiently identify complex and varied network attacks, especially those linked to low-frequency attacks. The SCGNet (Stacked Convolution with Gated Recurrent Unit Network) is a novel deep learning architecture that we propose in this study. It exhibits promising results on the NSL-KDD dataset in both task, network attack detection, and attack type classification with 99.76% and 98.92% accuracy, respectively. We have also introduced a general data preprocessing pipeline that is easily applicable to other similar datasets. We have also experimented with conventional machine-learning techniques to evaluate the performance of the data processing pipeline.

Paper Structure

This paper contains 15 sections, 1 equation, 5 figures, 4 tables.

Table of Contents

  1. SCGNet-Stacked Convolution with Gated Recurrent Unit Network for Cyber Network Intrusion Detection and Intrusion Type Classification
  2. Introduction
  3. Our Contribution:
  4. Literature Survey
  5. Methodology
  6. Dataset Description
  7. Data Preprocessing
  8. One hot Encoding for categorical variables
  9. Data Normalization for Numerical Variables
  10. Class Imbalance Issue (For Multiclass)
  11. Data Split and Model Training
  12. Machine Learning Models
  13. Deep Learning Architecture
  14. Result Analysis
  15. Conclusion and Future Work

Figures (5)

  • Figure 1: Our Proposed Workflow Diagram.
  • Figure 2: (a) Distribution of Training Data for Attack Detection, (b) Distribution of Test Data for Attack Detection, (c) Distribution of Train Data for Attack Type Detection, and (d) Distribution of Test Data for Attack Type Detection
  • Figure 3: SMOTE the Synthetic Minority Oversampling Technique 18_chawla2002smote.
  • Figure 4: Step by Step Flow of K-Fold Cross-Validation.
  • Figure 5: Cross Validation Process.