Present-day Internet consist of around half a million distinct networks. It might be challenging to categorize assaults in any network connection, since diferent attacks can have diferent connections and range in quantity from a few to hundreds of network connections. DS-based ML (Machine Learning) has been developed as a solution to this issue, monitoring and analyzing data packets to identify abnormal behaviors and novel assaults. The well-known NSLKDD datasets were utilized for this anomaly-based intrusion detection system. It comprises a significant number of computational time and features is more. The curse of dimensionality and data imbalance is the cause of the degradation in model accuracy that occurs with increased processing time, thus addressing these problems: (i) Using a feature selection method to include the features into the model and decrease their dimensionality which yields better results and requires less processing time than utilizing all the features, is still an issue for Internet-based transactions, communication, and IOT applications. Network intrusion detection is a crucial part of network security. However, hackers constantly developing new methods to breach networks and steal data mean that despite several algorithms' best eforts, it is still dificult to identify new invaders. At present, the widely used detection method trains the intrusion samples using conventional ML techniques to produce the intrusion detection model. However, these algorithms have the disadvantage of low detection rates. A more advanced technique called Deep Learning (DL) automatically identifies characteristics from samples and efectively classifies invaders. ∗Corresponding author. †These authors contributed equally.
People’s use of the Internet in daily life has significantly been increased. Secure communication CEUR Workshop Proceedings
ceur-ws.org ISSN1613-0073
In 2020, Meng Wang et al. [
The proposed method for intrusion detection involves 3 phases:
The training and feedback dataset, designated as Dt and Df, are two labelled datasets kept in the knowledge base. The samples applied to train the detection model makeup Dataset Dt, while the newly categorized and labelled samples from the detector’s detection process are contained in Dataset Df. 2.Detection model: The MLP model was employed as a classifier in this work, and the best features were chosen using a wrapper feature selection technique called SBS.
The MLP model was employed as a classifier in this work, and the best features were chosen using a wrapper feature selection technique called SBS. Algorithm 1. SBS-MLP Algorithm: Require: F0, M, Vvalidation , Dttest Ensure: F∗, M, Pcm F0 = {f1, f2, … … … fn} , F| = ∅, F1 = F0 Train M on train and validation with the features in 1 as inputs Test the trained M on, Dttest to get the feature saliency S(1,0) = 1 - Accuracy CF1 = S(1,0) for i = 1 to n − 1 do for each ∈ do H = Fi − f ( , ) = 1-accuracy end for f∗ = argminf (I,f) Fi+1 = Fi − f∗ CFi+1 = min S(i. ) End for Train on train and validation with the features in as Test the trained Mon D test to get the feature saliency F∗ = argminFi |Fi| subject to max (CFi) − CFi <= Train on train and validation with the features in ∗ as inputs Test the trained M on Dtest to” F∗, M, and Pcm
Return F∗, M, and Pcm
The feedback mechanism is in charge of identifying significant detection errors based on newly labeled samples that are entered into Df. It is only carried out if there are suficient attack samples, which are indicated by the number (or proportion) of newly labeled attack samples in Df (represented as Na) over a predetermined value (signified as N0).The mechanism’s basic hypothesis states that: if we retrain the detection model using the newly labeled samples during this time, after a certain amount of false-negative/positive errors in present detection have been accumulated, the retrained model’s detection accuracy on test data will show a distinguishable decrease.
Algorithm 2 Error perceiving algorithm:
The crucial decision-making threshold, denoted as , is calculated using the BienayméChebyshev inequality, which may be described as follows: while Na ≥ N0 do Read data from Df
Train M using the features in F∗ as as inputs for Df trained Df validation; test the trained M using Dt-test to obtain the confusion matrix Qcm.
Calculate detection accuracy aPandaQas per PcmandQcm = aP − aQ if > then Update Dt and use the updated Dt to carry out the SBS-MLP operation.
Update end if,end while.
1. The SBS-MLP method cannot guarantee the discovery of the global optimum features while a suboptimal solution is acceptable. 2. False-positive or false-negative responses might be produced by the feedback process.
An ensemble feature selection technique [
1. Proposed UEFFS method: Univariate Ensemble Filter Feature Selection
Proposed Algorithm Steps: 1. The suggested method involves computing features from the subsequent three incursion datasets: Kyoto, NSL-KDD, and Honey Pot. 2. An incursion dataset’s features were ranked using the five-univariate filter-based measures.
The first filter measure Information Gain was used to scale all of the calculated rankings. 3. The approach modifies the scale’s values (range between 0 to 1 ). The features that have the highest weights or ranks are ranked 1st. Each feature’s priority value was calculated using its unique measure score and weight. The suggested technique computes a mean to determine the rankings and significance of each attribute. 4. The subset for optimal features is chosen from the rated top percent feature sequences.
On the basis of threshold ( ) value, the top-ranked features from 80% of the datasets have been retained, while 20% of the lower-ranked features. were removed.
Drawback: 1. Multivariate measures to irrelevant feature selection. 2. Future work to the base models for the ensemble method would be to replace it with a deep neural network model in the selection process.
An Adaptable Deep Learning-Based Intrusion Detection System [? ] was introduced to Zero-Day Attacks. The proposed novelty-based framework for deep learning-based intrusion detection to adapt the deep classification models with zero-day attacks in the real world’s circumstances. This framework consists of four phases. first phase distinguishes the new attacks from the older ones. The second phase, a clustering module that links to a particular layer of the “deep classifier” model implements this phase by creating clusters out of the observed unidentified trafic.The third phase Supervised Labeling expert supervisor categorizes unknown trafic into four groups in the third phase: known harmful, new assault, undetected benign, and temporary anomalous trafic.The fourth phase updating the Model and collect results, The expert supervisor categorizes unknown trafic into four groups in the third phase: known harmful, new assault, undetected benign, and temporary anomalous trafic.
Drawback: Open set recognition, Supervised labeling, Clustering/post-training, and updating take more time complexity, and lack of accuracy.
A Robust Transformer-Based Approach [
RTIDS Algorithm [
Input: Training set S = (x−i, y−i), i = 1, 2, … N, x−i is the network trafic sample, y−i is the corresponding label
Output: Classification probabilities of the predicted class. 1: for i ← 0 until num Of Epochs do 2: for Sample s: Batch do get its vectorized representation sr put sr into encoder and decoder stacks for feature extraction and selection” use the transformer Model.MultiHead Attention function to compute the attention scores of features use transformer Model. SoftMax function to obtain classification probabilities use stochastic gradient descent (SGD) algorithm to minimize the loss function
Drawback: RNN-based methods have certain limitations in step-by-step processing. Their feature extraction at any given point in time only relies on the hidden state of previously observed information, possibly resulting in missing features in the context vector.
To handle above mentioned issues, we proposed a Deep transudative Federated transfer learning model.
Self-attention: self-attention relates the words to each other and sequence = m rows and dmodel = dk = m. The input Attribute values in the form of matrices Q.K.V. (
Q.K.V) = softmax (QKTT/√dk) V headi = Attention (QW ⋅ KWk ⋅ VW ) Multi headi = (ℎ1, ℎ2.......ℎ) (1) (2) (3)
The setup was created and carried out with Python programming language, and all suggested methods make use of the Kearas with Tensor flow backend framework. Experimental Environment Operating System Windows 10 pro 64-bit , Memory 64 GB CPU Intel(R) UHD Graphics 620, Anaconda 4.9.2, python 3.7.0, keras 2.4.2, Tensor flow 2.2.0
Accuracy =
TP + TN
TP + TN + FP + FN Sensitivity =
TP
TP + FP Specificity = TP
TP + FN F1-score = 2 × (Precision × Recall)/(Precision + Recall) (4) (5) (6) (7)
Overall Comparison of Results
We proposed a three phase intrusion detection model which is capable of recognizing multi-class assaults. For this, a Deep Transudative Federated Transfer learning model was referred. Our proposed CNN model achieved accuracy= 98%, precision = 99%, Recall= 98%, F1_score= 99% and is eficient to detect zero-day attacks.