Investigating Application of Deep Neural Networks in Intrusion Detection System Design
Mofe O. Jeje
TL;DR
The paper evaluates the applicability of deep neural networks, specifically a Multilayer Perceptron, for intrusion detection on the ASNM-TUN dataset. It employs Forward Feature Selection to reduce the feature space and assesses two- and three-class intrusion versus legitimate traffic. Results indicate limited detection performance, with approximately 0.77 accuracy for the two-class setting and around 0.66 for the three-class setting, with obfuscated attacks proving particularly challenging. The authors discuss feature importance via SHAP analyses and suggest combining DL models with additional approaches and prioritizing runtime efficiency for practical deployment, highlighting the need for improved methods to handle high-dimensional, obfuscated network traffic in IDS.
Abstract
Despite decades of development, existing IDSs still face challenges in improving detection accuracy, evasion, and detection of unknown attacks. To solve these problems, many researchers have focused on designing and developing IDSs that use Deep Neural Networks (DNN) which provides advanced methods of threat investigation and detection. Given this reason, the motivation of this research then, is to learn how effective applications of Deep Neural Networks (DNN) can accurately detect and identify malicious network intrusion, while advancing the frontiers of their optimal potential use in network intrusion detection. Using the ASNM-TUN dataset, the study used a Multilayer Perceptron modeling approach in Deep Neural Network to identify network intrusions, in addition to distinguishing them in terms of legitimate network traffic, direct network attacks, and obfuscated network attacks. To further enhance the speed and efficiency of this DNN solution, a thorough feature selection technique called Forward Feature Selection (FFS), which resulted in a significant reduction in the feature subset, was implemented. Using the Multilayer Perceptron model, test results demonstrate no support for the model to accurately and correctly distinguish the classification of network intrusion.