互联网使用的普遍性导致互联网流量的多样化,其中可能包含有关各种类型的Internet攻击的信息。近年来,许多研究人员已经将深度学习技术应用于入侵检测系统中,并获得了相当强的识别结果。然而,大多数实验都使用旧的数据集,所以他们不能反映最新的攻击信息。在本文中,CSE-CIC-IDS2018数据集和标准评估指标的当前状态已被用于评估所提出的机制.预处理数据集后,六个模型-深度神经网络(DNN),卷积神经网络(CNN)递归神经网络(RNN),长短期记忆(LSTM),CNN+RNN和CNN+LSTM是用来判断网络流量是否包含恶意攻击的。此外,进行了多分类实验,将流量分类为良性流量和六类恶意攻击:BruteForce,拒绝服务(DoS),网络攻击,浸润,僵尸网络,和分布式拒绝服务(DDoS)。每个模型在各种实验中都表现出很高的准确性,多类分类准确率均在98%以上。与其他论文的入侵检测系统(IDS)相比,该模型有效地提高了检测性能。此外,CNN+RNN和CNN+LSTM组合的推断时间比单个DNN的推断时间长,RNN和CNN。因此,DNN,考虑到算法在IDS设备中的实现,RNN和CNN优于CNN+RNN和CNN+LSTM。
The prevalence of internet usage leads to diverse internet traffic, which may contain information about various types of internet attacks. In recent years, many researchers have applied deep learning technology to intrusion detection systems and obtained fairly strong recognition results. However, most experiments have used old datasets, so they could not reflect the latest attack information. In this paper, a current state of the CSE-CIC-IDS2018 dataset and standard evaluation metrics has been employed to evaluate the proposed mechanism. After preprocessing the dataset, six models-deep neural network (DNN), convolutional neural network (CNN), recurrent neural network (RNN), long short-term memory (LSTM), CNN + RNN and CNN + LSTM-were constructed to judge whether network traffic comprised a malicious attack. In addition, multi-classification experiments were conducted to sort traffic into benign traffic and six categories of malicious attacks: BruteForce, Denial-of-service (DoS), Web Attacks, Infiltration, Botnet, and Distributed denial-of-service (DDoS). Each model showed a high accuracy in various experiments, and their multi-class classification accuracy were above 98%. Compared with the intrusion detection system (IDS) of other papers, the proposed model effectively improves the detection performance. Moreover, the inference time for the combinations of CNN + RNN and CNN + LSTM is longer than that of the individual DNN, RNN and CNN. Therefore, the DNN, RNN and CNN are better than CNN + RNN and CNN + LSTM for considering the implementation of the algorithm in the IDS device.