Anomaly-Based Intrusion Detection System using One-Dimensional Convolutional Neural Network
Ahmed Tamer Assy, Yahia Mostafa, Ahmed Abd El-khaleq, Maggie Mashaly
Abstract
As technologies in information and virtualization evolve, the volume of security threats attempting to cause damage to systems grows and becomes more powerful, which highlights the importance of Intrusion Detection Systems (IDS) to have an essential role in network security and help in detecting malicious attacks from network traffic. The most widely used network anomaly detection systems are based on Machine Learning (ML) techniques such as Decision Tree (DT), Support Vector Machine (SVM), and K-nearest Neighbors (KNN). Although IDSs based on ML techniques have achieved promising results and high detection rates, however, it is considered a type of shallow learning that depends mainly on feature engineering and requires large-scale data pre-processing as the size of the dataset grows. To overcome these problems, Deep learning-based IDSs are proposed because they have a better ability to extract features from huge amounts of data. In this research, an IDS model based on one-dimensional Convolution Neutron Network (CNN1D) is proposed that is able to detect anomalies with accuracy of 93.2% and F1-score of 93.1%. Entire NSL-KDD benchmark dataset was used to train this model. Achieved results are then compared to Deep Learning (DL) methods like CNN, LSTM, Recurrent Neural Network (RNN), and others to prove the proposed model's superiority over existing models in literature.