Deep Neural Network with Dropout for Anomaly Detection in Software Defined Networking

A novel anomaly detection-based NIDS is main demand in the computer networking security for discriminating malicious software attack at the early stage. It monitors and analyzes network traffics, checking abnormal behaviors or attack signatures. The detection rate or accuracy is the prerequisite in the network intrusion detection models, also, developing adaptive and flexible model is a critical challenge regarding to unseen attack. This search paper included the deep neural network (DNN) as anomaly detection model can be used within software defined networking (SDN). Dropout technique is used to prevent DNN model from overfitting. Six features have information about the flow were chosen from NSL-KDD dataset to fit and evaluate this model, these data features could be matched to packet-in message header values, also, these features enable the model to be a good generative, and well perform on intrusion recognition issue with a subset of the data. Cross entropy loss function with SoftMax output layer were used for getting the differences between the two different distribution and mapping to multiple class classification covered five class labels, one is normal and the others are attacks (Dos, R2L, U2L and Probe). Accuracy is a comparative metric utilized for assessing the model performance. The results are promising, where accuracy achieved 92.65%.

Download Full-text

Anomaly Detection Approach Based on Deep Neural Network and Dropout

Baghdad Science Journal ◽

10.21123/bsj.2020.17.2(si).0701 ◽

2020 ◽

Vol 17 (2(SI)) ◽

pp. 0701

Author(s):

Zaid Hussien et al.

Keyword(s):

Neural Network ◽

Feature Selection ◽

Intrusion Detection ◽

Anomaly Detection ◽

Deep Neural Network ◽

Detection System ◽

Early Stage ◽

High Detection Rate ◽

Network Intrusion ◽

Proposed Model

Regarding to the computer system security, the intrusion detection systems are fundamental components for discriminating attacks at the early stage. They monitor and analyze network traffics, looking for abnormal behaviors or attack signatures to detect intrusions in early time. However, many challenges arise while developing flexible and efficient network intrusion detection system (NIDS) for unforeseen attacks with high detection rate. In this paper, deep neural network (DNN) approach was proposed for anomaly detection NIDS. Dropout is the regularized technique used with DNN model to reduce the overfitting. The experimental results applied on NSL_KDD dataset. SoftMax output layer has been used with cross entropy loss function to enforce the proposed model in multiple classification, including five labels, one is normal and four others are attacks (Dos, R2L, U2L and Probe). Accuracy metric was used to evaluate the model performance. The proposed model accuracy achieved to 99.45%. Commonly the recognition time is reduced in the NIDS by using feature selection technique. The proposed DNN classifier implemented with feature selection algorithm, and obtained on accuracy reached to 99.27%.

Download Full-text

Anomaly Detection Using XGBoost Ensemble of Deep Neural Network Models

Cybernetics and Information Technologies ◽

10.2478/cait-2021-0037 ◽

2021 ◽

Vol 21 (3) ◽

pp. 175-188

Author(s):

Sumaiya Thaseen Ikram ◽

Aswani Kumar Cherukuri ◽

Babu Poorva ◽

Pamidi Sai Ushasree ◽

Yishuo Zhang ◽

...

Keyword(s):

Neural Network ◽

Deep Learning ◽

Anomaly Detection ◽

Deep Neural Network ◽

Short Term Memory ◽

Network Models ◽

Neural Network Models ◽

Detection Model ◽

Detection Systems ◽

Learning Techniques

Abstract Intrusion Detection Systems (IDSs) utilise deep learning techniques to identify intrusions with maximum accuracy and reduce false alarm rates. The feature extraction is also automated in these techniques. In this paper, an ensemble of different Deep Neural Network (DNN) models like MultiLayer Perceptron (MLP), BackPropagation Network (BPN) and Long Short Term Memory (LSTM) are stacked to build a robust anomaly detection model. The performance of the ensemble model is analysed on different datasets, namely UNSW-NB15 and a campus generated dataset named VIT_SPARC20. Other types of traffic, namely unencrypted normal traffic, normal encrypted traffic, encrypted and unencrypted malicious traffic, are captured in the VIT_SPARC20 dataset. Encrypted normal and malicious traffic of VIT_SPARC20 is categorised by the deep learning models without decrypting its contents, thus preserving the confidentiality and integrity of the data transmitted. XGBoost integrates the results of each deep learning model to achieve higher accuracy. From experimental analysis, it is inferred that UNSW_ NB results in a maximal accuracy of 99.5%. The performance of VIT_SPARC20 in terms of accuracy, precision and recall are 99.4%. 98% and 97%, respectively.

Download Full-text

A Novel Approach based on Lightweight Deep Neural Network for Network Intrusion Detection

2021 IEEE Wireless Communications and Networking Conference (WCNC) ◽

10.1109/wcnc49053.2021.9417568 ◽

2021 ◽

Author(s):

Ruijie Zhao ◽

Zhaojie Li ◽

Zhi Xue ◽

Tomoaki Ohtsuki ◽

Guan Gui

Keyword(s):

Neural Network ◽

Intrusion Detection ◽

Deep Neural Network ◽

Network Intrusion Detection ◽

Network Intrusion ◽

Novel Approach

Download Full-text

Edge-Detect: Edge-Centric Network Intrusion Detection using Deep Neural Network

2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC) ◽

10.1109/ccnc49032.2021.9369469 ◽

2021 ◽

Author(s):

Praneet Singh ◽

Jishnu Jaykumar P ◽

Akhil Pankaj ◽

Reshmi Mitra

Keyword(s):

Neural Network ◽

Intrusion Detection ◽

Deep Neural Network ◽

Network Intrusion Detection ◽

Network Intrusion

Download Full-text

Anomaly Detection Using Deep Neural Network for IoT Architecture

Applied Sciences ◽

10.3390/app11157050 ◽

2021 ◽

Vol 11 (15) ◽

pp. 7050

Author(s):

Zeeshan Ahmad ◽

Adnan Shahid Khan ◽

Kashif Nisar ◽

Iram Haider ◽

Rosilah Hassan ◽

...

Keyword(s):

Neural Network ◽

Deep Learning ◽

Anomaly Detection ◽

Deep Neural Network ◽

Detection System ◽

Traffic Monitoring ◽

Detection Accuracy ◽

Learning Models ◽

Prime Concern ◽

Entry Points

The revolutionary idea of the internet of things (IoT) architecture has gained enormous popularity over the last decade, resulting in an exponential growth in the IoT networks, connected devices, and the data processed therein. Since IoT devices generate and exchange sensitive data over the traditional internet, security has become a prime concern due to the generation of zero-day cyberattacks. A network-based intrusion detection system (NIDS) can provide the much-needed efficient security solution to the IoT network by protecting the network entry points through constant network traffic monitoring. Recent NIDS have a high false alarm rate (FAR) in detecting the anomalies, including the novel and zero-day anomalies. This paper proposes an efficient anomaly detection mechanism using mutual information (MI), considering a deep neural network (DNN) for an IoT network. A comparative analysis of different deep-learning models such as DNN, Convolutional Neural Network, Recurrent Neural Network, and its different variants, such as Gated Recurrent Unit and Long Short-term Memory is performed considering the IoT-Botnet 2020 dataset. Experimental results show the improvement of 0.57–2.6% in terms of the model’s accuracy, while at the same time reducing the FAR by 0.23–7.98% to show the effectiveness of the DNN-based NIDS model compared to the well-known deep learning models. It was also observed that using only the 16–35 best numerical features selected using MI instead of 80 features of the dataset result in almost negligible degradation in the model’s performance but helped in decreasing the overall model’s complexity. In addition, the overall accuracy of the DL-based models is further improved by almost 0.99–3.45% in terms of the detection accuracy considering only the top five categorical and numerical features.

Download Full-text