Efficient intrusion detection systems based on ensemble and deep learning network models

Abstract

Intrusion detection is the process of analyzing the network packets to identify if the packet is legitimate or anomalous. The major challenges involved in this domain includes the huge volume of data for training and the fast and streaming data that is to be provided for the prediction process. Further, the intrinsic data imbalance contained in the domain presents more challenges to the intrusion detection model. This work presents three major contributions for effective intrusion detection in the network domain. The initial contribution presents the Adaptive Parallelized Intrusion Detection (APID) model, an ensemble based model capable of handling streaming transactions. This is a bagging based model that creates multiple overlapping bags by sampling data from the training data. Each data is passed to a base learner and the resultant predictions are combined using a heuristic based voting combiner. The model also incorporates an ensemble retraining mechanism to enable inclusion of new signatures. The next contribution presents a Heterogeneous Bagging based Model (HBM), which is a streaming based model to perform real-time predictions. Heterogeneous base learners are created and each of the bags is trained using an instance of all the base learners. Bootstrap Aggregation is performed and Voting is used to provide the final prediction results. The final contribution presents a deep learning network based intrusion detection model, the MLDN. Data is appropriately pre-processed and passed to the deep learning model for the prediction process. The deep learning model is appropriately fitted for the given network intrusion data and the final predictions are obtained newline