A scalable and hybrid intrusion detection system based on the convolutional-LSTM network

Muhammad Ashfaq Khan, Md Rezaul Karim, Yangwoo Kim

Research output: Contribution to journalArticlepeer-review

138 Scopus citations

Abstract

With the rapid advancements of ubiquitous information and communication technologies, a large number of trustworthy online systems and services have been deployed. However, cybersecurity threats are still mounting. An intrusion detection (ID) system can play a significant role in detecting such security threats. Thus, developing an intelligent and accurate ID system is a non-trivial research problem. Existing ID systems that are typically used in traditional network intrusion detection system often fail and cannot detect many known and new security threats, largely because those approaches are based on classical machine learning methods that provide less focus on accurate feature selection and classification. Consequently, many known signatures from the attack traffic remain unidentifiable and become latent. Furthermore, since a massive network infrastructure can produce large-scale data, these approaches often fail to handle them flexibly, hence are not scalable. To address these issues and improve the accuracy and scalability, we propose a scalable and hybrid IDS, which is based on Spark ML and the convolutional-LSTM (Conv-LSTM) network. This IDS is a two-stage ID system: the first stage employs the anomaly detection module, which is based on Spark ML. The second stage acts as a misuse detection module, which is based on the Conv-LSTM network, such that both global and local latent threat signatures can be addressed. Evaluations of several baseline models in the ISCX-UNB dataset show that our hybrid IDS can identify network misuses accurately in 97.29% of cases and outperforms state-of-the-art approaches during 10-fold cross-validation tests.

Original languageEnglish
Article number583
JournalSymmetry
Volume11
Issue number4
DOIs
StatePublished - 1 Apr 2019

Keywords

  • CNN
  • Conv-LSTM
  • Deep learning
  • Intrusion detection system
  • LSTM
  • Spark ML

Fingerprint

Dive into the research topics of 'A scalable and hybrid intrusion detection system based on the convolutional-LSTM network'. Together they form a unique fingerprint.

Cite this