High Performance Network Intrusion Detection System Using Two-Stage LSTM and Incremental Created Hybrid Features

Citations Over TimeTop 10% of 2023 papers

Abstract

Currently, most network intrusion detection systems (NIDSs) use information about an entire session to detect intrusion, which has the fatal disadvantage of delaying detection. To solve this problem, studies have been proposed to detect intrusions using only some packets belonging to the session but have limited effectiveness in increasing the detection performance compared to conventional methods. In addition, space complexity is high because all packets used for classification must be stored. Therefore, we propose a novel NIDS that requires low memory storage space and exhibits high detection performance without detection delay. The proposed method does not need to store packets for the current session and uses only some packets, as in conventional methods, but achieves very high detection performance. Through experiments, it was confirmed that the proposed NIDS uses only a small memory of 25.8% on average compared to existing NIDSs by minimizing memory consumption for feature creation, while its intrusion detection performance is equal to or higher than those of existing ones. As a result, this method is expected to significantly help increase network safety by overcoming the disadvantages of machine-learning-based NIDSs using existing sessions and packets.

Related Papers

• Robotics research : The 13th International Symposium ISRR(2010)
• → INVITED SESSION, SESSION 32: LIVE SURGERY SESSION, Tuesday 5 July 2011 10:00 - 13:00(2011)1 cited
• → IUPsyS Invited Symposium, Poster Session, Oral Session, Keynote, State‐of‐the‐Art Session(2004)
• → The First Session: Preparation, Tasks, and Structure(2024)
• Proceedings of PART '98 : the 5th Australasian conference on Parallel and Real-Time Systems, University of Adelaide, Adelaide, Australia, 28-29 September 1998(1998)