DL-IDS: Extracting Features Using CNN-LSTM Hybrid Network for Intrusion Detection System

• Published in: Security and communication networks Vol. 2020; no. 2020; pp. 1 - 11
• Main Authors: Chen, Jinpeng, Lu, Xiangling, Liu, Chenxi, Li, Qi, Liu, Pengju, Sun, Pengfei, Hao, Ruochen
• Format: Journal Article
• Language: English
• Published: Cairo, Egypt Hindawi Publishing Corporation 2020; Hindawi; John Wiley & Sons, Inc
• Subjects: Accuracy; Algorithms; Artificial intelligence; Artificial neural networks; Behavior; Classification; Communications traffic; Datasets; Deep learning; False alarms; Feature extraction; Hybrid systems; Internet of Things; Intrusion detection systems; Machine learning; Natural language processing; Neural networks; Optimization; Research methodology; Security management; Support vector machines
• ISSN: 1939-0114; 1939-0122
• DOI: 10.1155/2020/8890306

Many studies utilized machine learning schemes to improve network intrusion detection systems recently. Most of the research is based on manually extracted features, but this approach not only requires a lot of labor costs but also loses a lot of information in the original data, resulting in low judgment accuracy and cannot be deployed in actual situations. This paper develops a DL-IDS (deep learning-based intrusion detection system), which uses the hybrid network of Convolutional Neural Network (CNN) and Long Short-Term Memory Network (LSTM) to extract the spatial and temporal features of network traffic data and to provide a better intrusion detection system. To reduce the influence of an unbalanced number of samples of different attack types in model training samples on model performance, DL-IDS used a category weight optimization method to improve the robustness. Finally, DL-IDS is tested on CICIDS2017, a reliable intrusion detection dataset that covers all the common, updated intrusions and cyberattacks. In the multiclassification test, DL-IDS reached 98.67% in overall accuracy, and the accuracy of each attack type was above 99.50%.