Efficacy of CNN-Bidirectional LSTM Hybrid Model for Network-Based Anomaly Detection
Efficacy of CNN-Bidirectional LSTM Hybrid Model for Network-Based Anomaly Detection
复制标题
DOI：
10.1109/iscaie57739.2023.10165088
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
Toya Acharya;A. Annamalai;M. Chouikha
中科院分区：
文献类型：
--
作者：
Toya Acharya;A. Annamalai;M. Chouikha
随着Web和Internet的发展，计算机网络已经成为数字化传输信息的重要工具，这增加了系统的威胁和脆弱性。网络攻击者可以使用互联网和工具来破坏CIA的三位一体（机密性，完整性和机密性）。网络异常检测在检测网络中的异常行为时是具有挑战性的，这是由于大规模数据、攻击类的不平衡性以及数据集中的大量特征。传统的机器学习方法在解决这些问题时效率不高。事实证明，深度学习在检测基于网络的异常方面更有效。设计了一个递归神经网络（RNN）模型来识别序列数据特征进行预测。我们提出了一个具有双向长短记忆的卷积神经网络（CNN Bi-LSTM）模型来分析超参数，包括优化器（Nadam，Adam，RMSprop，Adamax，SGD，Adagrad，Festival），epoch，批量大小，学习率以及CNN-BLSTM算法的神经网络模型架构。这些分析的超参数在NSL-KDD和UNSW-NB 15上分别提供了98.27%和99.87%的最高异常检测准确度。关于准确性和F1分数的性能评估显示，所提出的CNN Bi-LSTM异常检测模型比其他现有的异常检测方法表现出更好的性能。
With the development of the web and the internet, computer networks have become an important tool to transfer information digitally, that increases the system’s threats and vulnerability. Cyber attackers can use the internet and tools to compromise the triad of the CIA (confidentiality, integrity, and confidentiality). Network anomaly detection is challenging while detecting anomalous behavior in a network due to the large-scale data, imbalance nature of attacks class, and huge numbers of features in the dataset. Traditional Machine learning methods are not very efficient in solving those problems. Deep learning has proven to be more efficient in detecting network-based anomalies. A Recurrent Neural Network (RNN) model is designed to recognize the sequential data characteristics to predict. We proposed a convolutional neural network with bidirectional long-short memory (CNN Bi-LSTM) model to analyze the hyperparameters, including optimizers (Nadam, Adam, RMSprop, Adamax, SGD, Adagrad, Ftrl), epochs, batch size, learning rate, and neural network model architecture of CNN-BLSTM algorithms. Those analyzed hyperparameters provide the highest anomaly detection accuracy of 98.27% and 99.87% on the NSL-KDD and UNSW-NB15, respectively. Performance assessment regarding the accuracy and F1-score revealed that the proposed CNN Bi-LSTM anomaly detection model exhibited better performance than the other existing anomaly detection methods.