Model of the intrusion detection system based on the integration of spatial-temporal features

• Published in: Computers & security 2020-02, Vol.89, p.101681, Article 101681
• Main Authors: Zhang, Jianwu, Ling, Yu, Fu, Xingbing, Yang, Xiongkun, Xiong, Gang, Zhang, Rui
• Format: Article
• Language: English
• Subjects: Artificial neural networks; Communications traffic; Computer vision; Datasets; False alarms; Intrusion detection system; Intrusion detection systems; Long short-term memory; Model accuracy; Multiscale analysis; Multiscale convolutional neural network; Natural language processing; Neural networks; Short term; Spatial-temporal features; UNSW-NB15
• ISSN: 0167-4048; 1872-6208
• DOI: 10.1016/j.cose.2019.101681

The intrusion detection system can distinguish normal traffic from attack traffic by analyzing the characteristics of network traffic. Recently, neural networks have advanced in the fields of natural language processing, computer vision, intrusion detection and so on. In this paper, we propose a unified model combining Multiscale Convolutional Neural Network with Long Short-Term Memory (MSCNN-LSTM). The model first employs Multiscale Convolutional Neural Network(MSCNN) to analyze the spatial features of the dataset, and then employs Long Short-Term Memory (LSTM) Network to process the temporal features. Finally, the model employs the spatial-temporal features to perform the classification. In the experiment, the public intrusion detection dataset, UNSW-NB15 was employed as experimental training set and test set. Compared with the model based on the conventional neural networks, the MSCNN-LSTM model has better accuracy, false alarm rate and false negative rate.