Unsupervised GAN-Based Intrusion Detection System Using Temporal Convolutional Networks and Self-Attention

• Published in: IEEE eTransactions on network and service management 2023-12, Vol.20 (4), p.1-1
• Main Authors: de Araujo-Filho, Paulo Freitas, Naili, Mohamed, Kaddoum, Georges, Fapi, Emmanuel Thepie, Zhu, Zhongwen
• Format: Article
• Language: English
• Subjects: Anomaly detection; Computer architecture; Cyberattack; Cybersecurity; Edge computing; Generative Adversarial Network (GAN); Generative adversarial networks; Internet; Internet of Things; Internet of Things (IoT); Intrusion Detection System (IDS); Intrusion detection systems; Machine Learning; Modelling; Security; Self-Attention; Temporal Convolutional Network (TCN)
• ISSN: 1932-4537; 1932-4537
• DOI: 10.1109/TNSM.2023.3260039

Fifth-generation (5G) networks provide connectivity to a massive number of devices and boost a plethora of applications in several different domains. However, the large adoption of connected devices increases attack surfaces and introduces several security threats that can severely damage physical objects and risk people's lives. Despite existing intrusion detection systems (IDSs), there are still several challenges to be addressed in the detection of cyber-attacks. For instance, while unsupervised IDSs are required to detect zero-day attacks, they usually present high false positive rates. Moreover, most existing IDSs rely on long short-term memory (LSTM) networks to consider time-dependencies among data. However, LSTM networks have recently been shown to present several drawbacks and limitations, which put into question their performance on sequence modeling tasks. Thus, in this paper, we investigate generative adversarial networks (GANs), a promising unsupervised approach to detecting attacks by implicitly modeling systems, and alternatives to LSTM networks to consider temporal dependencies among data. We propose a novel unsupervised GAN-based IDS that uses temporal convolutional networks (TCNs) and self-attention to detect cyber-attacks. The proposed IDS leverages edge computing and is proposed for edge servers, which bring computation resources closer to end nodes. Experiment results show that our proposed IDS can be configured to satisfy different detection rate and detection time requirements. Moreover, they show that our IDS is more accurate and at least 3.8 times faster than two state-of-the-art GAN-based IDSs that are used as baselines.