[Paper Review] Intrusion Detection: A Deep Learning Approach

Ishaan Shivhare, Joy Purohit+3 more|arXiv (Cornell University)|Jun 13, 2023

Network Security and Intrusion Detection4 citations

TL;DR

This paper proposes a hybrid deep learning model combining Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM) networks, and Support Vector Machines (SVM) for multi-class intrusion detection. The architecture captures spatial features via CNN, temporal dependencies via LSTM, and improves classification accuracy, outperforming conventional machine learning and standalone deep learning methods on benchmark datasets.

ABSTRACT

Network intrusions are a significant problem in all industries today. A critical part of the solution is being able to effectively detect intrusions. With recent advances in artificial intelligence, current research has begun adopting deep learning approaches for intrusion detection. Current approaches for multi-class intrusion detection include the use of a deep neural network. However, it fails to take into account spatial relationships between the data objects and long term dependencies present in the dataset. The paper proposes a novel architecture to combat intrusion detection that has a Convolutional Neural Network (CNN) module, along with a Long Short Term Memory(LSTM) module and with a Support Vector Machine (SVM) classification function. The analysis is followed by a comparison of both conventional machine learning techniques and deep learning methodologies, which highlights areas that could be further explored.

Motivation & Objective

• To address the limitations of existing deep learning models in capturing spatial relationships and long-term dependencies in network intrusion data.
• To develop a hybrid deep learning architecture that integrates CNN, LSTM, and SVM for improved multi-class intrusion detection.
• To compare the proposed model with conventional machine learning and standalone deep learning approaches to evaluate performance gains.
• To identify gaps in current intrusion detection systems related to feature representation and sequence modeling.

Proposed method

• The model employs a CNN module to extract spatial features from network traffic data, capturing local patterns in packet-level features.
• An LSTM module is used to model sequential dependencies in the data, learning long-term temporal relationships across network flows.
• The output from the CNN-LSTM encoder is fed into an SVM classifier for final multi-class intrusion detection.
• The architecture is trained end-to-end on a public intrusion detection dataset, with hyperparameters tuned for optimal performance.
• The method leverages feature engineering to normalize and vectorize network traffic data before input to the deep learning components.
• The model is evaluated using standard metrics such as accuracy, precision, recall, and F1-score on a benchmark dataset.

Experimental results

Research questions

• RQ1 Can a hybrid CNN-LSTM-SVM model improve multi-class intrusion detection accuracy compared to standalone deep learning and traditional machine learning models?
• RQ2 How effectively do CNN and LSTM components capture spatial and temporal features in network intrusion data?
• RQ3 What is the impact of combining deep learning features with an SVM classifier on detection performance?
• RQ4 Which components of the model contribute most significantly to improved detection rates and reduced false positives?

Key findings

• The proposed CNN-LSTM-SVM model achieves higher detection accuracy than conventional machine learning models and standalone deep learning approaches on the benchmark dataset.
• The integration of CNN and LSTM modules significantly improves the model's ability to detect complex attack patterns by leveraging both spatial and temporal features.
• The SVM classifier enhances final classification performance, particularly in distinguishing between subtle or rare attack classes.
• The model demonstrates improved F1-score and reduced false positive rates compared to baseline models, indicating better generalization and robustness.