Study of long short-term memory in flow-based network intrusion detection system

Issue title: Special Section: Green and Human Information Technology

Guest editors: Seong Oun Hwang

Article type: Research Article

Authors: Nicholas, Lee^a | Ooi, Shih Yin^{a; *} | Pang, Ying Han^a | Hwang, Seong Oun^{b; *} | Tan, Syh-Yuan^a

Affiliations: [a] Faculty of Information Science and Technology, Multimedia University, Jalan Ayer Keroh Lama, Bukit Beruang, Melaka, Malaysia | [b] Department of Software and Communications Engineering, Hongik University, Sejong, Korea

Correspondence: [*] Corresponding authors. Shih Yin Ooi, Faculty of Information Science and Technology, Multimedia University, Jalan Ayer Keroh Lama, 75450 Bukit Beruang, Melaka, Malaysia. E-mail: syooi@mmu.edu.my. (S.Y. Ooi) and Seong Oun Hwang, Department of Software and Communications Engineering, Hongik University, Sejong, Korea. E-mail: sohwang@hongik.ac.kr (S.O. Hwang).

Abstract: The adoption of network flow in the domain of Network-based Intrusion Detection System (NIDS) has steadily risen in popularity. Typically, NIDS detects network intrusions by inspecting the contents of every packet. Flow-based approach, however, uses only features derived from aggregated packet headers. In this paper, all publicly accessible and labeled NIDS data sets are explored. Following the advances in deep learning techniques, the performances of Long Short-Term Memory (LSTM) are also presented and compared with various machine learning classifiers. Amongst the reviewed data sets, the models are trained and evaluated on CIDDS-001 flow-based data set.

Keywords: Intrusion detection system, NIDS, NetFlow, deep learning, LSTM

DOI: 10.3233/JIFS-169836

Journal: Journal of Intelligent & Fuzzy Systems, vol. 35, no. 6, pp. 5947-5957, 2018