Residual Dense Optimization-Based Multi-Attention Transformer to Detect Network Intrusion against Cyber Attacks
Abstract
:1. Introduction
- ⮚
- To minimize the effect of maximum or minimum value on overall features, original data is first normalized using the min-max method.
- ⮚
- To balance the classes, use SMOTE techniques, which help reduce overfitting issues.
- ⮚
- To introduce a Hybrid Genetic Fire Hawk Optimizer for choosing an optimal subset of features.
- ⮚
- The optimized residual dense-assisted multi-attention transformer model was used to classify the selected features.
2. Related Works/Literature Review
3. Proposed Methodology
3.1. Pre-Processing
- Min-max Normalization
- Synthetic Minority Oversampling Technique
3.2. Feature Selection Using Hybrid Genetic Fire Hawker Optimizer (FHO)
Algorithm 1: Pseudo-code for FHO algorithm. |
Procedure Fire Hawk Optimizer Establish the initial locations for a potential solution Calculate values of fitness for initial potential solutions Generate central fire as the global best solution while Iteration < Higher number of iterations Create the number of fire hawks for generating a random integer number Create preys and fire hawks in search space Evaluate the overall distance between prey and fire hawks Determine fire hawk location by integrating prey for Determine the fire hawks’ new location by utilizing Equation (8) for Estimate the safe location lower fire hawk area with Equation (11) Evaluate the prey’s location with Equation (9) Using Equation (12), calculate the fire hawk region outside the safe location Equation (10) can be utilized to evaluate the location of prey end end Determine the potential fitness values of recently generated fire hawks and prey By handling central fire, generate the global best solution end while Return end procedure |
Algorithm 2: Pseudo-code for GA-based HPO. |
Hyperparameter Optimization of Genetic Algorithm Input: Size of population: Total generations in maximum: Output: overall best solution (Top hyper-parameters): Step 1: Begin Step 2: Generate an initial chromosome population Step 3: Establish counter of generation Step 4: while do Step 5: Assess and update the CNN model Step 6: The subsequent generation (keep the fittest individual) Step 7: According to fitness, choose a chromosomal combination through people Step 8: Select crossover techniques to the recently chosen chromosome Step 9: Transform the offspring through mutation Step 10: Substitute the old population with the new one Step 11: Step 12: end Step 13: return Step 14: end |
3.3. Classification for Intrusion Detection Using Optimized Residual Dense-Assisted Multi-Attention Transformer
4. Results and Discussion
4.1. Dataset Description
4.1.1. UNSW-NB15
4.1.2. CICIDS2017
4.2. Analysis of Performance Metrics
4.3. Performance Evaluation of UNSW-NB15
4.4. Performance Analysis for CICIDS2017
4.5. Discussion
5. Conclusions
Funding
Institutional Review Board Statement
Informed Consent Statement
Data Availability Statement
Acknowledgments
Conflicts of Interest
References
- Alqahtani, H.; Sarker, I.H.; Kalim, A.; Minhaz Hossain, S.M.; Ikhlaq, S.; Hossain, S. Cyber intrusion detection using machine learning classification techniques. In Proceedings of the Computing Science, Communication and Security: First International Conference, COMS2 2020, Gujarat, India, 26–27 March 2020; Revised Selected Papers 1. Springer: Singapore, 2020; pp. 121–131. [Google Scholar]
- Mohammadi, S.; Mirvaziri, H.; Ghazizadeh-Ahsaee, M.; Karimipour, H. Cyber intrusion detection by combined feature selection algorithm. J. Inf. Secur. Appl. 2019, 44, 80–88. [Google Scholar] [CrossRef]
- Anwar, S.; Mohamad Zain, J.; Zolkipli, M.F.; Inayat, Z.; Khan, S.; Anthony, B.; Chang, V. From intrusion detection to an intrusion response system: Fundamentals, requirements, and future directions. Algorithms 2017, 10, 39. [Google Scholar] [CrossRef]
- He, H.; Sun, X.; He, H.; Zhao, G.; He, L.; Ren, J. A Novel Multimodal-Sequential Approach Based on Multi-View Features for Network Intrusion Detection. IEEE Access 2019, 7, 183207–183221. [Google Scholar] [CrossRef]
- Ring, M.; Wunderlich, S.; Gruedl, D.; Landes, D.; Hotho, A. Generation Scripts for the Coburg Intrusion Detection Data Sets (Cidds). 2017. Available online: https://github.com/markusring/CIDDS (accessed on 11 May 2020).
- Rashid, A.; Siddique, M.J.; Ahmed, S.M. Machine and Deep Learning Based Comparative Analysis Using Hybrid Approaches for Intrusion Detection System. In Proceedings of the 2020 3rd International Conference on Advancements in Computational Sciences (ICACS), Lahore, Pakistan, 17–19 February 2020; pp. 1–9. [Google Scholar]
- Małowidzki, M.; Berezinski, P.; Mazur, M. Network Intrusion Detection: Half a Kingdom for a Good Dataset. In Proceedings of the NATO STO SAS-139 Workshop, Lisbon, Portugal, 20–21 April 2015; Available online: https://pdfs.semanticscholar.org/b39e/0f1568d8668d00e4a8bfe1494b5a32a17e17.pdf (accessed on 2 February 2021).
- Al-Emadi, S.; Al-Mohannadi, A.; Al-Senaid, F. Using deep learning techniques for network intrusion detection. In Proceedings of the 2020 IEEE International Conference on Informatics, IoT, and Enabling Technologies (ICIoT), Doha, Qatar, 2–5 February 2020; pp. 171–176. [Google Scholar]
- Vinayakumar, R.; Soman, K.P.; Poornachandran, P. Applying convolutional neural network for network intrusion detection. In Proceedings of the 2017 International Conference on Advances in Computing, Communications and Informatics (ICACCI), Udupi, India, 13–16 September 2017. [Google Scholar] [CrossRef]
- Ciaburro, G.; Venkateswaran, B. Neural Networks with R: Smart Models Using CNN, RNN, Deep Learning, and Artificial Intelligence Principles; Packt Publishing: Birmingham, UK, 2017. [Google Scholar]
- Bottou, L.; Curtis, F.E.; Nocedal, J. Optimization methods for large-scale machine learning. Siam Rev. 2018, 60, 223–311. [Google Scholar] [CrossRef]
- Jyothsna, V.V.R.P.V.; Prasad, V.V.R.; Prasad, K.M. A review of anomaly-based intrusion detection systems. Int. J. Comput. Appl. 2011, 28, 26–35. [Google Scholar] [CrossRef]
- Hara, K.; Shiomoto, K. Intrusion detection system using semi-supervised learning with adversarial auto-encoder. In Proceedings of the NOMS 2020-2020 IEEE/IFIP Network Operations and Management Symposium, Budapest, Hungary, 20–24 April 2020; pp. 1–8. [Google Scholar]
- Sarker, I.H.; Kayes, A.S.M.; Badsha, S.; Alqahtani, H.; Watters, P.; Ng, A. Cybersecurity data science: An overview from a machine learning perspective. J. Big Data 2020, 7, 41. [Google Scholar] [CrossRef]
- Sarker, I.H.; Abushark, Y.B.; Alsolami, F.; Khan, A.I. Intrudtree: A machine learning-based cyber security intrusion detection model. Symmetry 2020, 12, 754. [Google Scholar] [CrossRef]
- Hnamte, V.; Nhung-Nguyen, H.; Hussain, J.; Hwa-Kim, Y. A novel two-stage deep learning model for network intrusion detection: LSTM-AE. IEEE Access 2023, 11, 37131–37148. [Google Scholar] [CrossRef]
- Kabir, M.H.; Rajib, M.S.; Rahman AS, M.T.; Rahman, M.M.; Dey, S.K. Network intrusion detection using UNSW-NB15 dataset: Stacking machine learning based approach. In Proceedings of the 2022 International Conference on Advancement in Electrical and Electronic Engineering (ICE), Gazipur, Bangladesh, 24–26 February 2022; pp. 1–6. [Google Scholar]
- Li, Z.; Luo, X.; Zhang, Y.; Yang, X.; Wang, X. HC-DTTSVM: A network intrusion detection method based on decision tree twin support vector machine and hierarchical clustering. IEEE Access 2023, 11, 21404–21416. [Google Scholar]
- Hu, X.; Meng, X.; Liu, S.; Liang, L. An Improved Algorithm for Network Intrusion Detection Based on Deep Residual Networks. IEEE Access 2024, 12, 66432–66441. [Google Scholar] [CrossRef]
- El-Rady, A.A.; Osama, H.; Sadik, R.; El Badwy, H. Network Intrusion Detection CNN Model for Realistic Network Attacks Based on Network Traffic Classification. In Proceedings of the 2023 40th National Radio Science Conference (NRSC), Giza, Egypt, 30 May–1 June 2023; Volume 1, pp. 167–178. [Google Scholar]
- Du, J.; Yang, K.; Hu, Y.; Jiang, L. NIDS-CNNLSTM: Network intrusion detection classification model based on deep learning. IEEE Access 2023, 11, 24808–24821. [Google Scholar] [CrossRef]
- Salazar, A.; Vargas, N.; Safont, G.; Vergara, L. Late Fusion for Improving Intrusion Detection in a Network Traffic Dataset. In Proceedings of the 2021 International Conference on Computational Science and Computational Intelligence (CSCI), Las Vegas, NV, USA, 15–17 December 2021; pp. 1684–1689. [Google Scholar] [CrossRef]
- Salazar, A.; Vergara, L.; Safont, G. Generative Adversarial Networks and Markov Random Fields for oversampling very small training sets. Expert Syst. Appl. 2021, 163, 113819. [Google Scholar] [CrossRef]
- Yi, H.; Jiang, Q.; Yan, X.; Wang, B. Imbalanced classification based on minority clustering smote with wind turbine fault detection application. IEEE Trans. Ind. Inform. 2020, 17, 5867–5875. [Google Scholar] [CrossRef]
- Shishehgarkhaneh, M.B.; Azizi, M.; Basiri, M.; Moehler, R.C. BIM-based resource tradeoff in project scheduling using fire hawk optimizer (FHO). Buildings 2022, 12, 1472. [Google Scholar] [CrossRef]
- Latif, S.; Boulila, W.; Koubaa, A.; Zou, Z.; Ahmad, J. DTL-IDS: An optimized Intrusion Detection Framework using Deep Transfer Learning and Genetic Algorithm. J. Netw. Comput. Appl. 2024, 221, 103784. [Google Scholar] [CrossRef]
- Figueiredo, J.; Serrão, C.; de Almeida, A.M. Deep learning model transposition for network intrusion detection systems. Electronics 2023, 12, 293. [Google Scholar] [CrossRef]
- Rao, Y.N.; Suresh Babu, K. An imbalanced generative adversarial network-based approach for network intrusion detection in an imbalanced dataset. Sensors 2023, 23, 550. [Google Scholar] [CrossRef] [PubMed]
Author and Reference | Model | Merits | Demerits |
---|---|---|---|
Hnamte et al. [16] | LSTM and AE |
|
|
Kabir et al. [17] | Two different ML models combined with extra tree classifier. |
|
|
Li et al. [18] | Decision tree twin SVM and hierarchical clustering |
|
|
Hu et al. [19] | Hybrid attention mechanism combined with enhanced algorithm |
|
|
El-Rady et al. [20] | Customized CNN |
|
|
Du et al. [21] | CNN and LSTM |
|
|
Installed RAM | 16.0 GB |
Pen and Touch | No pen or Touch Input is available. |
Type of System | x64-based process, 64-bit operating system |
Models | Accuracy | Precision | Recall |
---|---|---|---|
DBN | 92.3% | 0.00% | 0.00% |
RNN | 95.3% | 0.00% | 0.00% |
LR | 98.17% | 98% | 1.00 |
SGD | 97.9% | 98% | 1.00 |
Proposed | 98.82% | 97.2% | 98.5% |
Models | Accuracy | Precision | Recall | F1-Score |
---|---|---|---|---|
Single LSTM Layer | 97.7% | 0.00% | 0.00% | 96.9% |
Bi-directional LSTM | 97.7% | 0.00% | 0.00% | 97.6% |
CNN-LSTM | 93.0% | 86.4% | 76.8% | 81.3% |
Proposed | 99.12% | 98.6% | 98.2% | 98.8% |
Methods | Precision | Accuracy | F1-Score | Recall |
---|---|---|---|---|
LSTM and AE [16] | 0.00% | 99.0% | 0.00% | 0.00% |
Two different ML models combined with an extra tree classifier [17] | 0.00% | 96.2% | 0.00% | 0.00% |
A hybrid attention mechanism combined with an enhanced algorithm [19] | 95.03% | 96.3% | 95.0% | 95.19% |
Proposed Model | 98.6% | 99.12% | 98.8% | 98.2% |
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. |
© 2024 by the author. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Alsulami, M.H. Residual Dense Optimization-Based Multi-Attention Transformer to Detect Network Intrusion against Cyber Attacks. Appl. Sci. 2024, 14, 7763. https://doi.org/10.3390/app14177763
Alsulami MH. Residual Dense Optimization-Based Multi-Attention Transformer to Detect Network Intrusion against Cyber Attacks. Applied Sciences. 2024; 14(17):7763. https://doi.org/10.3390/app14177763
Chicago/Turabian StyleAlsulami, Majid H. 2024. "Residual Dense Optimization-Based Multi-Attention Transformer to Detect Network Intrusion against Cyber Attacks" Applied Sciences 14, no. 17: 7763. https://doi.org/10.3390/app14177763