 ICACT20220329 Slide.01
[Big Slide]
[YouTube] |
Chrome  Click!! |
 |
Hi everybody, my name is Jianping XIAO. For ICACT 2022, I have cooperated with five partners from CAS Dr. Chun LONG, Dr. Jinxia WEI, Ms. Jing ZHAO, Dr. Wei WAN and Dr. Guanyao. Our presentation today is about a intrusion detection system, which is Autoencoder ensembles for network intrusion detection. |
| ICACT20220329 Slide.02
[Big Slide]
|
Chrome Click!! |
 |
My presentation will mainly include six parts: Introduction; Related work; Background; Proposed model; Evaluation and Results; Conclusion and Future work. |
| ICACT20220329 Slide.03
[Big Slide]
|
Chrome Click!! |
 |
As we all know, Network Intrusion Detection systems (NIDS) can effectively detect network attacks. However, the existing network intrusion detection systems have the following defects: first of all, most current solutions often fail to accurately detect unknown attacks and have a high false alarm rate; second, the existing intrusion detection technologies require a lot of time overhead and training data, which are difficult to adapt to the real network environment. Therefore, it is necessary to solve the above problems. |
| ICACT20220329 Slide.04
[Big Slide]
|
Chrome Click!! |
 |
As shown in this ppt, there is already some research about network intrusion detection.The related research work in this field is described below. Considering the high-dimensional character of network traffic, data consists of many features. Xiao et al. [5] applied HMM to network intrusion detection based on abnormal traffic, took the traffic characteristics extracted based on principal component analysis (PCA) as the input value of HMM, and judged the type of traffic based on the probability of output. Chapaneri et al. [9] used Gaussian mixture model method to learn the statistical characteristics of each traffic category, and applied interquartile-based adaptive threshold technology to identify outliers. |
| ICACT20220329 Slide.05
[Big Slide]
|
Chrome Click!! |
 |
Li et al. [12] proposed an autoencoder intrusion detection system based on the random forest algorithm, which used shallow autoencoder neural network to reduce the computational complexity, shorten the detection time, and effectively improve the detection accuracy. Yisroel Mirsky et al. [13] proposed a online, unsupervised and efficient network intrusion detection system, which is Kitsune based on ANN. In this paper, we use autoencoder as the anomaly detection module, which is inspired by Kitsune. |
| ICACT20220329 Slide.06
[Big Slide]
|
Chrome Click!! |
 |
The autoencoder is the core part of the proposed model. Figure 1 illustrates the basic architecture of an autoencoder. |
| ICACT20220329 Slide.07
[Big Slide]
|
Chrome Click!! |
 |
The One-Class SVM is unsupervised. It is a novelty detection method. The goal of One-Class SVM is to fit a hyperplane as a boundary, which can best include all training data and exclude any other data points. One-Class SVM is considered to be one of the most mature outlier-based machine learning technologies. After One-Class SVM being trained, a spherical boundary will be formed. |
| ICACT20220329 Slide.08
[Big Slide]
|
Chrome Click!! |
 |
Next, we will introduce the proposed model. The overall framework of the model presented in Figure 2 consists of three steps. |
| ICACT20220329 Slide.09
[Big Slide]
|
Chrome Click!! |
 |
Next I will describe these three steps in detail.
STEP1: Data preprocessing. The two benchmark data sets NSL-KDD and CSE-CIC-IDS2018 used in the experiment need to be preprocessed.
STEP2: Feature selection. Recursive feature addition algorithm is applied to select the optimal subset of features.
STEP3: Anomaly detection. The anomaly detection part is composed of autoencoder and k-means. After feature selection, AP clustering algorithm is used to group feature subsets. Each features group corresponds to an autoencoder. These autoencoders ensembles compose the core of the anomaly detection module. The normal network data is used to train the detection model. After the model is deployed, the autoencoder processes the new incoming traffic and calculates the RMSE. The RMSE value is used to determine whether the network traffic is normal. K-means algorithm clusters the results according to the RMSE value. |
| ICACT20220329 Slide.10
[Big Slide]
|
Chrome Click!! |
 |
In the first part of experiments, we use NSL-KDD to verify the effectiveness of the recursive feature addition algorithm and conduct classification experiments on One-Class svm. |
| ICACT20220329 Slide.11
[Big Slide]
|
Chrome Click!! |
 |
We use recursive feature addition algorithm on NSL-KDD for feature selection. After feature selection, the One-Class SVM is trained according to the selected features. The Table 6 shows the results of One-Class SVM tested on NSL-KDD with all features and the optimal subset of features. Next, we compare the training and detection time of the One-Class SVM model before and after feature selection, as shown in Table 7. Therefore, according to the detection results of the NSL-KDD dataset, the recursive feature addition algorithm is effective. |
| ICACT20220329 Slide.12
[Big Slide]
|
Chrome Click!! |
 |
In the second part of experiments, we evaluate the performance of the proposed anomaly detection model on CSE-CIC-IDS 2018. |
| ICACT20220329 Slide.13
[Big Slide]
|
Chrome Click!! |
 |
We compare the experimental results on the sparse and dense matrix. Table 8 is the results of the confusion matrix. The results show that the use of sparse matrix and dense matrix for detection can significantly improve the accuracy and efficiency of detection. For most of the sub-datasets such as Botnet, DoS attack-SlowHTTPTest, FTP-BruteForce, DDoS attack-HOIC, SSH-Bruteforce, we can get relatively good detection results. |
| ICACT20220329 Slide.14
[Big Slide]
|
Chrome Click!! |
 |
We hope our model can achieve a high recall rate. Table 9 shows the performance of our model and KitNet in terms of recall rate. On the same dataset, the experimental results show that the overall recall rate of our model is better than KitNet. It is noted that the distribution of normal data and abnormal data in some sub-datasets is unbalanced. Overall, it is clear that our model can maintain good recall rate and adapt well to the environment with unbalanced data distribution. |
| ICACT20220329 Slide.15
[Big Slide]
|
Chrome Click!! |
 |
We also compare the detection time by our model and KitNet on the same dataset, as shown in Table 10. After splitting the original dataset into the sparse matrix and the dense matrix, the amount of data is significantly reduced, so the detection time will be less. From Table 10, we can see that using KitNet for detection takes a long time, because it does not divide the datasets, and uses all the features for training. However, the recursive feature addition algorithm of our model also consumes a lot of time, which still needs to be improved.
|
| ICACT20220329 Slide.16
[Big Slide]
|
Chrome Click!! |
 |
Now, we come to the last part —Conclusion and Future work. Our model RFA-AE is a lightweight intrusion detection model based on feature selection and autoencoder. It consists of the following three parts: data preprocessing, feature selection and anomaly detection. Experimental results show that our model can speed up training and detection time, and accurately detect attacks. |
| ICACT20220329 Slide.17
[Big Slide]
|
Chrome Click!! |
 |
In the future research, we attempt to use real network traffic data to further evaluate our model. |
| ICACT20220329 Slide.18
[Big Slide]
|
Chrome Click!! |
 |
References. |
| ICACT20220329 Slide.19
[Big Slide]
|
Chrome Click!! |
 |
References. |
| ICACT20220329 Slide.20
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
That’s all for my presentation. If you have any questions, please feel free to contact me. Thank you! |
