Network Intrusion Detection Based on Extended RBF Neural Network with Offline Reinforcement Learning

Network intrusion detection focuses on classifying network traffic as either normal or attack carrier. The classification is based on information extracted from the network flow packets. This is a complex classification problem with unbalanced datasets and noisy data. This work extends the classic r...

Full description

Saved in:
Bibliographic Details
Published in:IEEE access 2021-01, Vol.9, p.1-1
Main Authors: Lopez-Martin, Manuel, Sanchez-Esguevillas, Antonio, Arribas, Juan Ignacio, Carro, Belen
Format: Article
Language:English
Subjects:
Algorithms
Classification
Communication system security
Communications traffic
Datasets
Dispersion
Intrusion detection
Intrusion detection systems
Machine learning
Network intrusion detection
Neural networks
Optimization
Optimization methods
Particle swarm optimization
Performance measurement
Radial basis function
Radial basis function networks
Reinforcement learning
Service introduction
Training
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Network intrusion detection focuses on classifying network traffic as either normal or attack carrier. The classification is based on information extracted from the network flow packets. This is a complex classification problem with unbalanced datasets and noisy data. This work extends the classic radial basis function (RBF) neural network by including it as a policy network in an offline reinforcement learning algorithm. With this approach, all parameters of the radial basis functions (along with the network weights) are learned end-to-end by gradient descent without external optimization. We further explore how additional dense hidden-layers, and the number of radial basis kernels influence the results. This novel approach is applied to five prominent intrusion detection datasets (NSL-KDD, UNSW-NB15, AWID, CICIDS2017 and CICDDOS2019) achieving better performance metrics than alternative state-of-the-art models. Each dataset provides different restrictions and challenges allowing a better validation of results. Analysis of the results shows that the proposed architectures are excellent candidates for designing classifiers with the constraints imposed by network intrusion detection. We discuss the importance of dataset imbalance and how the proposed methods may be critically important for unbalanced datasets.
ISSN:2169-3536
2169-3536
DOI:10.1109/ACCESS.2021.3127689