A Convolutional Neural Network with Hyperparameter Tuning for Packet Payload-Based Network Intrusion Detection
Abstract
:1. Introduction
- We define a new multiclass classification model for intrusion detection based on convolutional neural networks (CNNs).
- We use raw network traffic datasets (raw pcap files) to train and test the proposed model instead of preprocessed datasets (feature-ready CSV files). So, input features are automatically extracted.
- We propose an innovative methodology for converting raw network traffic to a 2D representation, which is better suited to convolutional neural networks.
- We use a hyperparameter tuning method based on the self-adaptive differential evolution (SADE) algorithm to adaptively optimize the structure of the proposed CNN-based intrusion detection model.
- We evaluate the performance of the proposed model using three different datasets, namely, KDD-99, UNSW-NB15, and CIC-IDS2017.
2. Related Work
3. Proposed Intrusion Detection Framework
3.1. Data Preparation
3.2. Data Reformulation
- First, we generate four different frequency distribution vectors for each network session’s compact payload. The first one is generated immediately from the original compact payload by counting the number of times each byte value occurs in the compact payload data. As is well known, a byte has 8 bits, so it can take values ranging from 0 to 255. As a result, the four frequency vectors generated each have 256 elements: the first element contains the frequency of occurrence of the value 0 in the various bytes of the compact payload, the second element contains the frequency of the value 1, and so on. The three remaining vectors are generated in the same way, shifting the payload by two bits each time.
- Second, we merge the four frequency distribution vectors into a single frequency vector of 1024 elements. The overall algorithm for these first two stages is shown in Algorithm 1.
Algorithm 1: Generation of the frequency vector - Third, we change the shape of the obtained 1D frequency distribution vector to a 2D frequency distribution vector. As our frequency vector is 1024 elements long, we can easily change it into a squared 2D vector of size without having to add any padding values. The generated 2D vector is considered as a grayscale image.
3.3. Model Training
3.3.1. Overall Structure of Our CNN-Based Model
3.3.2. CNN Structure and Hyperparameter Tuning
4. Implementation and Experiments
4.1. Dataset Description
- KDD’99 is the most commonly used dataset for the evaluation of intrusion detection systems. It was created by the MIT Lincoln Laboratory and the Air Force Research Laboratory for participation in an international competition conducted in 1999. The dataset was generated over five weeks (weeks 1–5). The first and third weeks are free of attacks, whereas the second, fourth, and fifth weeks include the network traffic of 58 different attack types divided into 4 categories: denial-of-service attacks (DoS), user-to-root attacks (U2R), remote-to-local attacks (R2L), and probing attacks.
- UNSW-NB15 is a network intrusion detection dataset that was created in 2015 by the Cyber Range Lab of the Australian Center for Cyber Security (ACCS). The original raw traffic, amounting to approximately 100 GB, was collected during two simulation periods, each lasting about 15 h, on 22 January 2015 and 17 February 2015, respectively. The dataset comprises nine different attack categories, namely, fuzzers, analysis, backdoors, DoS, exploits, generic, reconnaissance, shellcode, and worms.
- CIC-IDS2017 is a recent dataset consisting of network data collected by the Canadian Institute of Cyber Security in 2017. The dataset contains both benign and malicious raw network traffic collected over five days from Monday, 3 July 2017, to Friday, 7 July 2017. The first day contains only benign traffic, while the other days contain various types of attacks, namely DoS attacks (Hulk, GoldenEye, Slowloris, and Slowhttptest), web attacks (Brute Force, XSS, and SQL Injection), patator attacks (FTP and SSH), heartbleed attacks, infiltration attacks, botnet attacks, port scan attacks, and DDoS attacks.
4.2. Evaluation Metrics
- Accuracy (ACC) is a metric that refers to the rate of samples correctly classified for a particular class type i, and it is calculated as follows [35]:
- Precision (PR) is a metric that measures the rate of samples correctly classified for a particular class type i given all predictions of that class. Its formula is given by [35]:
- Recall (RC) is a metric that measures the rate of samples correctly classified for a particular class type i given all occurrences of that class type. It is calculated by the following formula [35]:
- F-Score (F1) is a metric that measures the harmonic mean of precision and recall per class type i. Its formula is given as follows [35]:
4.3. Hyperparameters Setting
Algorithm 2: Optimization of our CNN hyperparameters using the SaDE metaheuristic. |
|
5. Experiment Results and Discussion
5.1. Training Performance
5.2. Performance Measurement on the Test Dataset
5.3. Computational Efficiency Measurement
5.4. Comparison with State-of-the-Art Works
6. Conclusions
Author Contributions
Funding
Data Availability Statement
Conflicts of Interest
References
- Admass, W.S.; Munaye, Y.Y.; Diro, A.A. Cyber security: State of the art, challenges and future directions. Cyber Secur. Appl. 2024, 2, 100031. [Google Scholar] [CrossRef]
- Kwon, H.; Kim, Y.; Yoon, H.; Choi, D. Optimal cluster expansion-based intrusion tolerant system to prevent denial of service attacks. Appl. Sci. 2017, 7, 1186. [Google Scholar] [CrossRef]
- Cuan, Z.; Ren, Y.; Ding, D.W. Adaptive intrusion tolerant control for a class of uncertain nonlinear cyber-physical systems with full-state constraints. Automatica 2024, 166, 111728. [Google Scholar] [CrossRef]
- Agrawal, S.; Sarkar, S.; Aouedi, O.; Yenduri, G.; Piamrat, K.; Alazab, M.; Bhattacharya, S.; Maddikunta, P.K.R.; Gadekallu, T.R. Federated Learning for intrusion detection system: Concepts, challenges and future directions. Comput. Commun. 2022, 195, 346–361. [Google Scholar] [CrossRef]
- Sowmya, T.; Mary Anita, E. A comprehensive review of AI based intrusion detection system. Meas. Sens. 2023, 28, 100827. [Google Scholar] [CrossRef]
- Lee, S.W.; Mohammed Sidqi, H.; Mohammadi, M.; Rashidi, S.; Rahmani, A.M.; Masdari, M.; Hosseinzadeh, M. Towards secure intrusion detection systems using deep learning techniques: Comprehensive analysis and review. J. Netw. Comput. Appl. 2021, 187, 103111. [Google Scholar] [CrossRef]
- Sajed, S.; Sanati, A.; Garcia, J.E.; Rostami, H.; Keshavarz, A.; Teixeira, A. The effectiveness of deep learning vs. traditional methods for lung disease diagnosis using chest X-ray images: A systematic review. Appl. Soft Comput. 2023, 147, 110817. [Google Scholar] [CrossRef]
- Abade, A.; Ferreira, P.A.; de Barros Vidal, F. Plant diseases recognition on images using convolutional neural networks: A systematic review. Comput. Electron. Agric. 2021, 185, 106125. [Google Scholar] [CrossRef]
- Pingale, S.V.; Sutar, S.R. Remora whale optimization-based hybrid deep learning for network intrusion detection using CNN features. Expert Syst. Appl. 2022, 210, 118476. [Google Scholar] [CrossRef]
- Asgharzadeh, H.; Ghaffari, A.; Masdari, M.; Soleimanian Gharehchopogh, F. Anomaly-based intrusion detection system in the Internet of Things using a convolutional neural network and multi-objective enhanced Capuchin Search Algorithm. J. Parallel Distrib. Comput. 2023, 175, 1–21. [Google Scholar] [CrossRef]
- Altaf, T.; Wang, X.; Ni, W.; Liu, R.P.; Braun, R. NE-GConv: A lightweight node edge graph convolutional network for intrusion detection. Comput. Secur. 2023, 130, 103285. [Google Scholar] [CrossRef]
- Daoud, M.; Dahmani, Y.; Bendaoud, M.; Ouared, A.; Ahmed, H. Convolutional neural network-based high-precision and speed detection system on CIDDS-001. Data Knowl. Eng. 2023, 144, 102130. [Google Scholar] [CrossRef]
- Hnamte, V.; Hussain, J. Dependable intrusion detection system using deep convolutional neural network: A Novel framework and performance evaluation approach. Telemat. Informa. Rep. 2023, 11, 100077. [Google Scholar] [CrossRef]
- Vinayakumar, R.; Alazab, M.; Soman, K.P.; Poornachandran, P.; Al-Nemrat, A.; Venkatraman, S. Deep Learning Approach for Intelligent Intrusion Detection System. IEEE Access 2019, 7, 41525–41550. [Google Scholar] [CrossRef]
- Li, Y.; Xu, Y.; Liu, Z.; Hou, H.; Zheng, Y.; Xin, Y.; Zhao, Y.; Cui, L. Robust detection for network intrusion of industrial IoT based on multi-CNN fusion. Measurement 2020, 154, 107450. [Google Scholar] [CrossRef]
- Andresini, G.; Appice, A.; Caforio, F.P.; Malerba, D.; Vessio, G. ROULETTE: A neural attention multi-output model for explainable Network Intrusion Detection. Expert Syst. Appl. 2022, 201, 117144. [Google Scholar] [CrossRef]
- Udas, P.B.; Karim, M.E.; Roy, K.S. SPIDER: A shallow PCA based network intrusion detection system with enhanced recurrent neural networks. J. King Saud Univ. -Comput. Inf. Sci. 2022, 34, 10246–10272. [Google Scholar] [CrossRef]
- Brandon, B.; Anitha, C.; Ana, G.; Daisy, L. BLoCNet: A hybrid, dataset-independent intrusion detection system using deep learning. Int. J. Inf. Secur. 2023, 22, 893–917. [Google Scholar] [CrossRef]
- Wang, S.; Xu, W.; Liu, Y. Res-TranBiLSTM: An intelligent approach for intrusion detection in the Internet of Things. Comput. Netw. 2023, 235, 109982. [Google Scholar] [CrossRef]
- He, J.; Wang, X.; Song, Y.; Xiang, Q. A multiscale intrusion detection system based on pyramid depthwise separable convolution neural network. Neurocomputing 2023, 530, 48–59. [Google Scholar] [CrossRef]
- Li, Y.; Qin, T.; Huang, Y.; Lan, J.; Liang, Z.; Geng, T. HDFEF: A hierarchical and dynamic feature extraction framework for intrusion detection systems. Comput. Secur. 2022, 121, 102842. [Google Scholar] [CrossRef]
- Liu, J.; Song, X.; Zhou, Y.; Peng, X.; Zhang, Y.; Liu, P.; Wu, D.; Zhu, C. Deep anomaly detection in packet payload. Neurocomputing 2022, 485, 205–218. [Google Scholar] [CrossRef]
- Qiu, W.; Ma, Y.; Chen, X.; Yu, H.; Chen, L. Hybrid intrusion detection system based on Dempster-Shafer evidence theory. Comput. Secur. 2022, 117, 102709. [Google Scholar] [CrossRef]
- Lin, K.; Xu, X.; Xiao, F. MFFusion: A Multi-level Features Fusion Model for Malicious Traffic Detection based on Deep Learning. Comput. Netw. 2022, 202, 108658. [Google Scholar] [CrossRef]
- Yu, L.; Dong, J.; Chen, L.; Li, M.; Xu, B.; Li, Z.; Qiao, L.; Liu, L.; Zhao, B.; Zhang, C. PBCNN: Packet Bytes-based Convolutional Neural Network for Network Intrusion Detection. Comput. Netw. 2021, 194, 108117. [Google Scholar] [CrossRef]
- Crowley, J.L. Convolutional Neural Networks. In Human-Centered Artificial Intelligence: Advanced Lectures; Springer International Publishing: Cham, Switzerland, 2023; pp. 67–80. [Google Scholar] [CrossRef]
- Gu, J.; Wang, Z.; Kuen, J.; Ma, L.; Shahroudy, A.; Shuai, B.; Liu, T.; Wang, X.; Wang, G.; Cai, J.; et al. Recent advances in convolutional neural networks. Pattern Recognit. 2018, 77, 354–377. [Google Scholar] [CrossRef]
- Aggarwal, C.C. Neural Networks and Deep Learning—A Textbook; Springer: Berlin/Heidelberg, Germany, 2023. [Google Scholar] [CrossRef]
- Huang, V.; Qin, A.; Suganthan, P. Self-adaptive Differential Evolution Algorithm for Constrained Real-Parameter Optimization. In Proceedings of the 2006 IEEE International Conference on Evolutionary Computation, Vancouver, BC, Canada, 16–21 July 2006; pp. 17–24. [Google Scholar] [CrossRef]
- Storn, R.; Price, K. Differential evolution–a simple and efficient heuristic for global optimization over continuous spaces. J. Glob. Optim. 1997, 11, 341–359. [Google Scholar] [CrossRef]
- Cui, L.; Li, G.; Zhu, Z.; Wen, Z.; Lu, N.; Lu, J. A novel differential evolution algorithm with a self-adaptation parameter control method by differential evolution. Soft Comput. 2018, 22, 6171–6190. [Google Scholar] [CrossRef]
- DARPA. DARPA Intrusion Detection Data Sets; DARPA: Arlington, VA, USA, 1999; Available online: https://www.ll.mit.edu/r-d/datasets/1999-darpa-intrusion-detection-evaluation-dataset (accessed on 8 July 2024).
- Moustafa, N.; Slay, J. UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia, 10–12 November 2015; pp. 1–6. [Google Scholar] [CrossRef]
- Sharafaldin, I.; Habibi Lashkari, A.; Ghorbani, A.A. Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. In Proceedings of the 4th International Conference on Information Systems Security and Privacy—ICISSP. INSTICC, SciTePress, Funchal, Portugal, 22–24 January 2018; pp. 108–116. [Google Scholar] [CrossRef]
- Sokolova, M.; Lapalme, G. A systematic analysis of performance measures for classification tasks. Inf. Process. Manag. 2009, 45, 427–437. [Google Scholar] [CrossRef]
- Geron, A. Hands-On Machine Learning with Scikit-Learn, Keras, and TensorFlow: Concepts, Tools, and Techniques to Build Intelligent Systems, 2nd ed.; O’Reilly Media, Inc.: Sebastopol, CA, USA, 2019. [Google Scholar]
- Ding, H.; Chen, L.; Dong, L.; Fu, Z.; Cui, X. Imbalanced data classification: A KNN and generative adversarial networks-based hybrid approach for intrusion detection. Future Gener. Comput. Syst. 2022, 131, 240–254. [Google Scholar] [CrossRef]
- Shah, B.; Bhavsar, H. Time Complexity in Deep Learning Models. Procedia Comput. Sci. 2022, 215, 202–210. [Google Scholar] [CrossRef]
- Zhang, Y.; Qiao, S.; Zeng, Y.; Gao, D.; Han, N.; Zhou, J. CAE-CNN: Predicting transcription factor binding site with convolutional autoencoder and convolutional neural network. Expert Syst. Appl. 2021, 183, 115404. [Google Scholar] [CrossRef]
- Lopez-Martin, M.; Carro, B.; Sanchez-Esguevillas, A.; Lloret, J. Shallow neural network with kernel approximation for prediction problems in highly demanding data networks. Expert Syst. Appl. 2019, 124, 196–208. [Google Scholar] [CrossRef]
- Shams, E.A.; Rizaner, A.; Ulusoy, A.H. A novel context-aware feature extraction method for convolutional neural network-based intrusion detection systems. Neural Comput. Appl. 2021, 33, 13647–13665. [Google Scholar] [CrossRef]
- Andresini, G.; Appice, A.; De Rose, L.; Malerba, D. GAN augmentation to deal with imbalance in imaging-based intrusion detection. Future Gener. Comput. Syst. 2021, 123, 108–127. [Google Scholar] [CrossRef]
- Gupta, N.; Jindal, V.; Bedi, P. CSE-IDS: Using cost-sensitive deep learning and ensemble algorithms to handle class imbalance in network-based intrusion detection systems. Comput. Secur. 2022, 112, 102499. [Google Scholar] [CrossRef]
- Jiaxing, H.; Xiaodan, W.; Qian, S.Y.X.; Chen, C. Network intrusion detection based on conditional wasserstein variational autoencoder with generative adversarial network and one-dimensional convolutional neural networks. Appl. Intell. 2023, 53, 12416–12436. [Google Scholar] [CrossRef]
- Kasongo, S.M.; Sun, Y. A deep learning method with wrapper based feature extraction for wireless intrusion detection system. Comput. Secur. 2020, 92, 101752. [Google Scholar] [CrossRef]
- Kwon, H.; Nam, S.H. Audio adversarial detection through classification score on speech recognition systems. Comput. Secur. 2023, 126, 103061. [Google Scholar] [CrossRef]
Refs. | Year | Datasets | Format | Output | Description |
---|---|---|---|---|---|
[9] | 2022 | NSL-KDD, UNSW-NB15, and CICIDS2017 | CSV | B | Combines DMNs and DAEs in a hybrid deep model for intrusion detection while using CNNs for feature extraction. |
[10] | 2023 | NSL-KDD, and TON-IoT | CSV | B | Develops an IoT intrusion detection model using CNNs for feature extraction, BME-CSA for feature selection, and RF for classification. |
[11] | 2023 | UNSW-NB15 | CSV | B | Proposes the NE-GConv framework, which uses RFE for feature selection and GCN for classification. |
[12] | 2023 | CIDDS-001 | CSV | B | Introduces a deep learning-based intrusion detection model using PCA for feature reduction and CNNs for classification. |
[13] | 2023 | ISCX-IDS12, DDoS (Kaggle), CICIDS2017, and CICIDS2018 | CSV | B | Develops a network intrusion detection model based on DCNNs. |
[14] | 2019 | NSL-KDD, UNSW-NB15, Kyoto, WSN-DS, and CICIDS2017 | CSV | B+M | Presents a performance analysis of various machine learning algorithms on different datasets before selecting a single DNN architecture composed of five hidden layers. |
[15] | 2020 | NSL-KDD | CSV | B+M | Develops a network intrusion detection model using a multi-CNN fusion method. |
[16] | 2022 | NSL-KDD and UNSW-NB15 | CSV | M | Applies a CNN with an attention mechanism that produces an attention map on the flow characteristics of specific attack categories. |
[17] | 2022 | NSL-KDD and UNSW-NB15 | CSV | B+M | Combines PCA and CNNs with four updated versions of conventional RNNs, namely, Bi-LSTM, LSTM, Bi-GRU, and GRU. |
[18] | 2023 | UNSW-NB15, CICIDS2017, IoT-23, and Bot-IoT | CSV | M | Proposes a hybrid network intrusion detection model by combining CNNs and Bi-LSTM. |
[19] | 2023 | NSL-KDD and CICIDS2017 | CSV | M | Combines CNNs with Bi-LSTMs and transformers to implement a deep learning-based model for IoT intrusion detection. |
[20] | 2023 | NSL-KDD, UNSW-NB15 and CICIDS2017 | CSV | M | Proposes a CNN-based intrusion detection model in which features are extracted using VGM, PyCNN, and DSC methods. |
[21] | 2022 | UNSW-NB15, CICIDS2017 and CSE-CICIDS2018 | pcap | B | Proposes an LSTM-based intrusion detection model in which a hierarchical and dynamic feature extraction framework is defined to extract features from packet traffic. |
[22] | 2022 | CSIC2010, ISCX2012, and CICIDS2017 | pcap | B | Combines CNNs with LSTMs and multihead self-attention mechanisms to construct an efficiency payload-based anomaly detection framework. |
[23] | 2022 | ISCX-bot-2014, ISCX-SlowDoS-2016, and CICIDS2017 | pcap | M | Develops a hybrid intrusion detection system that combines a pcap-based CNN model with a CSV-based RF model using the Dempster–Shafer Theory (DST). |
[24] | 2022 | ISCXIDS2012, CICIDS2017, and IoT23 | pcap | M | Proposes a deep learning-based model for intrusion detection with a multilevel feature (data timing, byte, and statistical features) fusion method. |
[25] | 2021 | CICIDS2017 and CSE-CICIDS2018 | pcap | M | Proposes a CNN-based model for intrusion detection in which features are extracted from the packet bytes at two levels (abstract level and final representation level). |
Dataset | Class | Training | Validation | Test | Total |
---|---|---|---|---|---|
KDD’99 | Normal | 21,768 | 2466 | 6154 | 30,388 |
DoS | 31,171 | 3472 | 8675 | 43,318 | |
Probe | 11,675 | 1297 | 3246 | 16,218 | |
R2L | 539 | 64 | 156 | 759 | |
U2R | 79 | 10 | 25 | 114 | |
Total | 65,232 | 7309 | 18,256 | 90,797 | |
UNSW-NB15 | Normal | 17,870 | 800 | 4671 | 23,341 |
Analysis | 289 | 14 | 84 | 387 | |
Backdoors | 327 | 54 | 78 | 459 | |
DoS | 2935 | 520 | 701 | 4156 | |
Exploits | 18,856 | 3213 | 4491 | 26,560 | |
Fuzzers | 14,752 | 661 | 3993 | 19,406 | |
Generic | 2725 | 517 | 632 | 3874 | |
Reconnaissance | 8276 | 1733 | 1856 | 11,865 | |
Shellcode | 1049 | 223 | 225 | 1497 | |
Worms | 116 | 23 | 27 | 166 | |
Total | 67,195 | 7758 | 16,758 | 91,711 | |
CIC-IDS2017 | Normal | 25,552 | 2878 | 7186 | 35,616 |
Bot | 531 | 59 | 148 | 738 | |
DDoS | 32,434 | 3604 | 9010 | 45,048 | |
DoS GoldenEye | 613 | 70 | 186 | 869 | |
DoS Hulk | 4314 | 480 | 1203 | 5997 | |
DoS Slowhttptest | 1010 | 114 | 284 | 1408 | |
DoS slowloris | 1609 | 179 | 447 | 2235 | |
FTP-Patator | 2444 | 271 | 679 | 3394 | |
PortScan | 42,154 | 4684 | 11,710 | 58,548 | |
SSH-Patator | 1715 | 191 | 476 | 2382 | |
Brute Force | 108 | 12 | 31 | 151 | |
Sql Injection | 9 | 1 | 2 | 12 | |
XSS | 15 | 2 | 6 | 23 | |
Total | 112,508 | 12,545 | 31,368 | 156,421 |
Hyperparameter | Range |
---|---|
# of filters for the 1st conv. layer | |
# of filters for the 2nd conv. layer | |
# of neurons in the hidden layer | |
Dropout rate | |
Learning rate | |
Batch size | |
Batch normalization |
Hyperparameter | Setting |
---|---|
Convolution kernel size | |
Convolution stride size | 1 |
Pooling kernel size | |
Pooling stride size | 2 |
Pooling type | Max |
Activation function | ReLu |
Weight initialization | Xavier |
Optimization function | Adam |
Training epochs | 10 |
Parameter | Value |
---|---|
Population size (NP) | 15 |
Number of generations (G) | 100 |
Learning period (LP) | 18 |
update period (_p) | 9 |
Hyperparameter | KDD’99 | UNSW-NB15 | CIC-IDS2017 |
---|---|---|---|
# of filters for the 1st conv. layer | 32 | 16 | 32 |
# of filters for the 2nd conv. layer | 32 | 16 | 0 |
# of neurons in the hidden layer | 0 | 128 | 0 |
Dropout rate | 0.2 | 0.1 | 0.1 |
Learning rate | 0.001 | 0.001 | 0.001 |
Batch size | 64 | 32 | 256 |
Batch normalization | 0 | 0 | 0 |
Dataset | Conv1 | Conv2 | Dense | Total |
---|---|---|---|---|
KDD’99 | 294,912 | 9,437,184 | 163,840 | 9,895,936 |
UNSW-NB15 | 147,456 | 2,621,184 | 4,195,584 | 6,964,224 |
CIC-IDS2017 | 294,912 | - | 425,984 | 720,896 |
Dataset | Ref. | Year | Model | Balan.? | Accuracy | Precision | Recall | F-Score | |||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Macro | Weight. | Macro | Weight. | Macro | Weight. | ||||||||
KDD’99 | [14] | 2019 | DNN | No | 0.7850 | 0.8100 | - | 0.7850 | - | 0.7650 | - | ||
[15] | 2020 | CNN | No | 0.8133 | 0.6947 | - | 0.6384 | - | 0.6418 | - | |||
[17] | 2022 | RNN | No | 0.8291 | 0.7127 | 0.8678 | 0.5789 | 0.8291 | 0.5917 | 0.8041 | |||
[16] | 2022 | CNN | No | 0.8150 | - | - | - | - | 0.6130 | 0.7900 | |||
[20] | 2023 | CNN | No | 0.8163 | 0.8355 | - | 0.8163 | - | 0.8063 | - | |||
[40] | 2019 | DNN | No | 0.8070 | - | 0.8180 | - | 0.8070 | - | 0.7930 | |||
[41] | 2021 | CNN | Yes | 0.8334 | - | 0.8535 | - | 0.8344 | - | 0.8260 | |||
[37] | 2022 | DNN | Yes | 0.9297 | 0.8556 | - | 0.6340 | - | 0.6702 | - | |||
[42] | 2021 | CNN | Yes | 0.9329 | - | - | - | - | - | 0.9566 | |||
[43] | 2022 | DNN | Yes | 0.9200 | 0.7480 | - | 0.7560 | - | 0.7480 | - | |||
[44] | 2023 | CNN | Yes | 0.9011 | - | 0.9073 | - | 0.9011 | - | 0.8990 | |||
[19] | 2023 | RNN | Yes | 0.9099 | 0.9139 | - | 0.9094 | - | 0.9089 | - | |||
Ours | CNN | No | 0.9810 | 0.9711 | 0.9809 | 0.8577 | 0.9810 | 0.9032 | 0.9808 | ||||
UNSW-NB15 | [14] | 2019 | DNN | No | 0.6600 | 0.6230 | - | 0.6600 | - | 0.5960 | - | ||
[17] | 2022 | RNN | No | 0.7286 | 0.6322 | 0.8198 | 0.5413 | 0.7137 | 0.5254 | 0.7372 | |||
[16] | 2022 | CNN | No | 0.7640 | - | - | - | - | 0.4240 | 0.7670 | |||
[20] | 2023 | CNN | No | 0.8047 | 0.8074 | - | 0.8047 | - | 0.7889 | - | |||
[40] | 2019 | DNN | No | 0.7780 | - | 0.7720 | - | 0.7780 | - | 0.7730 | |||
[45] | 2020 | DNN | No | 0.8092 | - | - | - | - | - | - | |||
[37] | 2022 | DNN | Yes | - | 0.7508 | - | 0.8479 | - | 0.7964 | - | |||
[42] | 2021 | CNN | Yes | 0.8973 | - | - | - | - | - | 0.9197 | |||
[44] | 2023 | CNN | Yes | 0.8886 | - | 0.9046 | - | 0.8896 | - | 0.8771 | |||
[18] | 2023 | C+R | Yes | 0.7632 | 0.4500 | 0.8100 | 0.4500 | 0.7600 | 0.4100 | 0.7700 | |||
Ours | CNN | No | 0.9340 | 0.9463 | 0.9321 | 0.8275 | 0.9340 | 0.8696 | 0.9281 | ||||
CIC-IDS2017 | [14] | 2019 | DNN | No | 0.9620 | 0.9720 | - | 0.9620 | - | 0.9650 | - | ||
[20] | 2023 | CNN | No | 0.9760 | 0.9073 | - | 0.9781 | - | 0.9413 | - | |||
[41] | 2021 | CNN | Yes | 0.9929 | - | 0.9928 | - | 0.9929 | - | 0.9927 | |||
[42] | 2021 | CNN | Yes | 0.9849 | - | 0.9520 | - | 0.9740 | - | 0.9628 | |||
[43] | 2022 | DNN | Yes | 0.9200 | 0.6743 | - | 0.8171 | - | - | 0.7000 | |||
[25] | 2021 | CNN | No | - | 0.7460 | 0.9820 | 0.7480 | 0.9830 | 0.7467 | 0.9830 | |||
[18] | 2023 | C+R | Yes | 0.9800 | 0.8800 | 0.9900 | 0.8400 | 0.9800 | 0.8100 | 0.9800 | |||
[19] | 2023 | RNN | Yes | 0.9915 | 0.9915 | - | 0.9914 | - | 0.9914 | - | |||
Ours | CNN | No | 0.9981 | 0.9920 | 0.9982 | 0.9546 | 0.9981 | 0.9667 | 0.9981 |
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. |
© 2024 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Boulaiche, A.; Haddad, S.; Lemouari, A. A Convolutional Neural Network with Hyperparameter Tuning for Packet Payload-Based Network Intrusion Detection. Symmetry 2024, 16, 1151. https://doi.org/10.3390/sym16091151
Boulaiche A, Haddad S, Lemouari A. A Convolutional Neural Network with Hyperparameter Tuning for Packet Payload-Based Network Intrusion Detection. Symmetry. 2024; 16(9):1151. https://doi.org/10.3390/sym16091151
Chicago/Turabian StyleBoulaiche, Ammar, Sofiane Haddad, and Ali Lemouari. 2024. "A Convolutional Neural Network with Hyperparameter Tuning for Packet Payload-Based Network Intrusion Detection" Symmetry 16, no. 9: 1151. https://doi.org/10.3390/sym16091151