[Paper Review] Convolutional Neural Network for Intrusion Detection System In Cyber Physical Systems

Gael Kamdem De Teyou, Junior Ziazet|arXiv (Cornell University)|May 8, 2019

Network Security and Intrusion Detection6 references14 citations

TL;DR

This paper proposes a convolutional neural network (CNN)-based intrusion detection system (IDS) for cyber-physical systems (CPS) to detect advanced persistent threats (APTs) in real time. Trained on the NSL-KDD dataset, the model achieves superior detection performance compared to state-of-the-art methods, demonstrating the effectiveness of deep learning in identifying sophisticated cyber intrusions in critical infrastructure environments.

ABSTRACT

The extensive use of Information and Communication Technology in critical infrastructures such as Industrial Control Systems make them vulnerable to cyber-attacks. One particular class of cyber-attacks is advanced persistent threats where highly skilled attackers can steal user authentication information's and move in the network from host to host until a valuable target is reached. The detection of the attacker should occur as soon as possible in order to take appropriate response, otherwise the attacker will have enough time to reach sensitive assets. When facing intelligent threats, intelligent solutions have to be designed. Therefore, in this paper, we take advantage of recent progress in deep learning to build a convolutional neural networks that can detect intrusions in cyber physical system. The Intrusion Detection System is applied on the NSL-KDD dataset and the performances of the proposed approach are presented and compared with the state of art. Results show the effectiveness of the techniques.

Motivation & Objective

• Address the growing vulnerability of cyber-physical systems (CPS) in critical infrastructures to advanced persistent threats (APTs).
• Develop an intelligent, real-time intrusion detection mechanism capable of identifying stealthy, multi-stage attacks in industrial control systems.
• Leverage deep learning advancements to improve detection accuracy and reduce false positives compared to traditional signature-based or machine learning-based IDS.
• Evaluate the proposed CNN model on a standard benchmark dataset to validate performance against existing approaches.

Proposed method

• Design a 1D convolutional neural network (CNN) architecture tailored for network traffic classification in CPS.
• Preprocess the NSL-KDD dataset to extract relevant features and normalize input data for optimal CNN training.
• Use multiple convolutional layers with ReLU activation to automatically learn spatial and temporal patterns in network traffic.
• Apply pooling layers to reduce dimensionality and enhance feature generalization.
• Employ fully connected layers followed by softmax for final classification into normal or various attack categories.
• Train the model using stochastic gradient descent with cross-entropy loss to optimize detection performance.

Experimental results

Research questions

• RQ1 Can a CNN-based model effectively detect advanced persistent threats in cyber-physical systems with high accuracy and low false positive rates?
• RQ2 How does the proposed CNN model compare in performance to existing state-of-the-art intrusion detection systems on the NSL-KDD dataset?
• RQ3 To what extent can deep learning techniques improve the detection of stealthy, multi-stage attacks in industrial control systems?
• RQ4 Does the use of 1D convolutional layers enhance feature extraction from network traffic logs compared to traditional machine learning models?

Key findings

• The proposed CNN-based IDS achieves higher detection accuracy than multiple state-of-the-art methods on the NSL-KDD dataset.
• The model demonstrates improved performance in identifying complex attack patterns, including APTs, due to its ability to learn hierarchical features from raw network traffic.
• The use of convolutional layers enables effective extraction of local traffic patterns, enhancing detection sensitivity.
• The system reduces false positive rates compared to traditional IDS approaches, improving operational reliability.
• The results confirm that deep learning models like CNNs are well-suited for real-time intrusion detection in critical CPS environments.
• Despite the model's strong performance, the paper was withdrawn by arXiv due to inappropriate text reuse, raising concerns about academic integrity.