深度学习驱动的云端实时网络入侵检测系统比较

需积分: 0 134 浏览量更新于2024-08-05 收藏 892KB PDF 举报

本研究论文由王雪妍等人在"使用深度学习的基于云的实时网络入侵检测"项目中探讨，发表于爱尔兰国家学院计算机科学系。他们的工作着重于利用深度学习技术来提升网络入侵检测的实时性能。在云环境中，他们开发了一个原型系统，旨在评估深度学习在二分类（binomial classification）和多分类（multinomial models）任务中检测网络入侵的能力。研究者们选择了H2O和DeepLearning4J两个流行的深度学习库，通过NSL-KDD基准数据集进行了实验。NSL-KDD数据集是网络安全领域的一个标准测试集，包含了多种类型的攻击样本，用于比较深度学习模型与传统机器学习算法如支持向量机（Support Vector Machines）、随机森林（Random Forest）、逻辑回归（Logistic Regression）和朴素贝叶斯（Naive Bayes）的性能。实验结果显示，选择适当的深度学习库对于实现实时网络入侵检测至关重要。深度学习模型在处理复杂模式识别和特征提取方面具有优势，能够在短时间内进行高效且准确的判断，这对于防止和应对网络攻击具有重要意义。然而，选择哪个库取决于具体的应用场景、计算资源限制以及模型的性能优化需求。因此，本文不仅提供了深度学习在实时网络入侵检测中的应用实例，还强调了实践中对库选择策略的考虑。这项研究为云环境下的实时网络安全防护提供了一种新颖且可能更有效的方法，进一步推动了深度学习在信息安全领域的前沿研究。随着深度学习技术的不断发展和优化，未来有望看到更多针对实时网络威胁检测的创新解决方案。

Cloud-based Real-time Network Intrusion Detection

Using Deep Learning

Santhosh Parampottupadam, and Arghir-Nicolae Moldovann

School of Computing, National College of Ireland, Mayor Street, IFSC, Dublin 1, Ireland

E-mail: santhosh.parampottupadam@student.ncirl.ie; arghir.moldovan@ncirl.ie

Abstract—Deep learning has increased in popularity with

researchers and developers investigating and using it for various

use cases and applications. This research work focuses on real-

time network intrusion detection by making use of deep learning.

A cloud-based prototype system was developed to investigate

the capability of deep learning based binomial classiﬁcation and

multinomial models to detect network intrusions in real-time. An

evaluation study was carried out using the benchmark NSL-KDD

dataset to compare deep learning models built using H2O and

DeepLearning4J libraries, with other commonly used machine

learning models such as Support Vector Machines, Random

Forest, Logistic Regression and Na

ıve Bayes. The results showed

that the choice of the deep learning library is an important factor

to consider for real-time applications. The H2O deep learning

based binomial and multinomial models generally outperformed

the other models, achieving over 99.5% accuracy using cross-

validation on the NSL-KDD training dataset and over 83%

accuracy on the test dataset.

Index Terms—Network security, intrusion detection, deep

learning, cloud computing, NSL-KDD.

I. INTR ODUCTION

Internet and related technologies such as networking and

cloud computing are the backbone of a multitude of applica-

tions and services that are used for every aspect of modern life,

from work, education to entertainment. Ericsson [1] estimated

that by 2020 there will be over 8.6 billion connected phones,

1.7 billion connected PCs and tablets, and 18.1 billion IoT

devices. With the increasing dependence on online services,

cyber security attacks represent a major risk facing users and

businesses [2]. Notorious cyber attacks include the Yahoo

breach when 3 billion user accounts were compromised, and

the Target stores breach when the credit card information of

110 million users was compromised [3]. While organizations

are working hard build better security features by incorporating

recent attack types, new attacks are continuously emerging.

In this context there is increasing need for new solutions to

predict and prevent network intrusion attacks in real-time.

According to Wang and Jones [4], intrusion detection can

be categorized into 3 types based on its detection mecha-

nism: anomaly-based detection, signature based detection, and

hybrid detection which is a combination of the other two.

These detection systems are based on studying the network

parameters and body contents once an attack has happened.

The anomaly based detection systems analyse the attacks

payload information, and other information such as the source

and destination port and internet protocol addresses to build

the anomaly model [5]. These models tend to be efﬁcient when

the same attack comes again into the system, as these models

are built based on the previous attack parameters. But as new

attacks arise more effective self-learning models should be

implemented in order to enable systems to predict and prevent

yet unseen attacks.

Deep learning has emerged as a new solution that has

the potential to provide more effective network intrusion

detection as it uses algorithms such as feed forward and

back propagation [6]. Smith [7] described best practices for

building novel applications using machine learning models and

suggested developing deep learning based neural networks for

intrusion detection.

This paper investigates the capability of using deep learning

models for network intrusion detection in real-time. A cloud

hosted prototype system was developed that combines a deep

learning binomial classiﬁcation model to predict if there is

an intrusion, with a multinomial model to identify the attack

category. The prototype system integrates deep learning mod-

els built using the H2O framework [8], as well a messaging

service to alert the network administrator. An evaluation study

was carried out using the well-known benchmarked NSL-KDD

dataset [9] to compare the H2O deep learning models with

models built using DeepLearning4J, LibSVM, Random Forest,

Logistic Regression and Na

ıve Bayes. The results showed that

H2O deep learning models generally outperformed the other

models, achieving over 99.5% accuracy using cross-validation

on the training dataset and over 83% accuracy on the test

dataset, for both binomial and multinomial classiﬁcation.

The rest of the paper is structured as follows. Section II

presents previous research works on network intrusion de-

tection. Section III present the methodology of this research

study, while section IV describes the prototype system. Sec-

tion V presents the evaluation results, while section VI con-

cludes the paper and presents future work directions.

II. RELATED WORK

A. Anomaly Based Network Intrusion Detection

Anomaly based intrusion detection is usually the ﬁrst stage

of defence [4]. Cui and He [10] proposed a solution that used

Hadoop MapReduce to process the input data and supply it

to the Weka machine learning framework. The drawbacks are

that the entire MapReduce iteration must be run again when

下载后可阅读完整内容，剩余7页未读，立即下载

东郊椰林放猪散仙

粉丝: 24
资源: 301

深度学习驱动的云端实时网络入侵检测系统比较

基于深度学习的基于云的车辆网络物理入侵检测18-王雪妍1

基于深度神经网络的车载网络安全入侵检测新方法-王雪妍1

使用区块链保护个人数据-王雪妍1

Saduj-OS:2021操作系统课程作业

风华产业论文最终版.doc

lab7-os

传媒行业：2月中国手游市场规模增幅明显，IP价值有望继续提升.pdf

精通J2EE—Eclipse Struts Hibernate Spring 整合应用案例源代码1

2021六（3）班语文学习总结.docx

基于java的人事管理系统设计与实现.docx

最新资源