A network intrusion detection tool can identify and detect potential malicious activities or attacks by monitoring network traffic and system logs. The data within intrusion detection networks possesses characteristics that include a high degree of feature dimension and an unbalanced distribution across categories. Currently, the actual detection accuracy of some detection models is relatively low. To solve these problems, we propose a network intrusion detection model based on multi-head attention and BiLSTM (Bidirectional Long Short-Term Memory), which can introduce different attention weights for each vector in the feature vector that strengthen the relationship between some vectors and the detection attack type. The model also utilizes the advantage that BiLSTM can capture long-distance dependency relationships to obtain a higher detection accuracy. This model combined the advantages of the two models, adding a dropout layer between the two models to improve the detection accuracy while preventing training overfitting. Through experimental analysis, the network intrusion detection model that utilizes multi-head attention and BilSTM achieved an accuracy of 98.29%, 95.19%, and 99.08% on the KDDCUP99, NSLKDD, and CICIDS2017 datasets, respectively.

A Network Intrusion Detection Model Based on BiLSTM with Multi-Head Attention Mechanism

As time series data with internal correlation, networks traffic data can be used for abnormal detection using Recurrent Neural Network (RNN) and its variants, but existing models are difficult to calculate in parallel, and gradient explosion or vanishing easily occurs. To address this problem, we propose a Bidirectional Independent Recurrent Neural Network (BiIndRNN) with parallel computation and adjustable gradient, which can extract the bidirectional structural features of networks traffic by forward and backward input and capture the spatial influence in the data flow. To establish the dependencies on the forward and backward moments of networks traffic, a model combining Global Attention (GA) with BiIndRNN is proposed to pay more attention to the moments containing essential information. Taking the UNSW-NB15 dataset as the object, the GA expression of the packets feature vector of the networks is derived, feature fusion, as well as loss calculation, is performed for multiple fully connected layers. The experimental results show that, compared with traditional deep and shallow machine learning and other state-of-the-art technologies, our GA-BiIndRNN model converges faster, the accuracy, precision, and F1 scores are all above 99%, and the false positive rate (FPR) is close to 0.36%, which can effectively identify normal and malicious network activities. These results provide a theoretical basis for the rapid implementation of protective measures. 

/pdf/an-abnormal-traffic-detection-model-combined-biindrnn-with-2nfi01to.pdf

An Abnormal Traffic Detection Model Combined BiIndRNN With Global Attention

As time series data with internal correlation, networks traffic data can be used for abnormal detection using Recurrent Neural Network (RNN) and its variants, but existing models are difficult to calculate in parallel, and gradient explosion or vanishing easily occurs. To address this problem, we propose a Bidirectional Independent Recurrent Neural Network (BiIndRNN) with parallel computation and adjustable gradient, which can extract the bidirectional structural features of networks traffic by forward and backward input and capture the spatial influence in the data flow. To establish the dependencies on the forward and backward moments of networks traffic, a model combining Global Attention (GA) with BiIndRNN is proposed to pay more attention to the moments containing essential information. Taking the UNSW-NB15 dataset as the object, the GA expression of the packets feature vector of the networks is derived, feature fusion, as well as loss calculation, is performed for multiple fully connected layers. The experimental results show that, compared with traditional deep and shallow machine learning and other state-of-the-art technologies, our GA-BiIndRNN model converges faster, the accuracy, precision, and F1 scores are all above 99%, and the false positive rate (FPR) is close to 0.36%, which can effectively identify normal and malicious network activities. These results provide a theoretical basis for the rapid implementation of protective measures.

Intrusion detection is one of the effective ways to secure the network. Based the unbalanced network traffic data between different attacks, the intrusion detection algorithm turns out to be low intrusion detection accuracy and low identification rate of minority attacks. To solve the problems, an improved intrusion detection model combined with one-dimensional convolutional neural network and bidirectional gated recurrent unit(1D-ICNN-BiGRU) is proposed. First, the dataset is balanced by the SMOTE-Tomek algorithm, then 1D-ICNN-BiGRU is performed for feature extraction, and the final fully connected layer of the model is replaced by global average pooling. The results show that based on the balanced data, the proposed model achieves higher intrusion detection accuracy for R2L and U2R attack than other classic intrusion detection models. The proposed model also improved the identification rate of minority attacks, making the model accuracy rate reach 95.53%, and the false positive rate is only 2.98%.

Research on intrusion detection method based on 1D-ICNN-BiGRU

We present NadGPT, a transformer-based semi-supervised framework for network anomaly detection. It is known that transformer models are good at modeling long sequence data such as network traffic; however, without sufficient ground-truth labels, transformer models tend to suffer from over-fitting thus leading to inferior performance. Inspired by the recent success of GPT models in natural language processing (NLP), we propose a new auxiliary self-supervised task plugged to the backbone transformer, which enables GPT-like auto-regressive training on network traffic sequence without using ground-truth labels. Experiments demonstrate the proposed method greatly reduces the requirements of labels in network anomaly detection. For example, on ISCX 2012 dataset, given only 0.05% training labels our semi-supervised approach obtains nontrivial 81.7% (2-class) and 64.9% (5-class) Fl-scores on the validation set, which is far better than the supervised counterparts using the same training data. We hope our research could inspire more label-efficient methods in network traffic analysis. 

NadGPT: Semi-Supervised Network Anomaly Detection via Auto-Regressive Auxiliary Prediction

In recent years, various types of network attacks emerge in endlessly, the protection of network security has been paid more and more attention by our society. Network Intrusion Detection System (NIDS)is used to protect computer systems from malicious attacks and intrusions, thus has also become a hot research field. Due to the great success of deep learning in industry and academia, there is an increasing interest in the application of deep learning methods for feature representations and classification. In this paper,we propose a intrusion detection model based on time-related deep learning approach with attention mechanism. Firstly, we build a stacked sparse autoencoder(SSAE) to extract high-level feature representations of intrusion information. Then we design a two-layer bidirectional gated recurrent unit(BiGRU) network with attention mechanism to classify traffic data. We perform experiments on a benchmark dataset UNSW-NB15, the results in binary classification indicate that using high-dimensional sparse features extracted by SSAE can significantly accelerate the classification progress. Our model can detect network intrusions effectively and outperform other related methods with reduction of false alarm rate, high accuracy rate, reduced training and testing time.

An Efficient Intrusion Detection Model Combined Bidirectional Gated Recurrent Units With Attention Mechanism

The invention provides a time sequence related network intrusion detection method based on an attention mechanism. The method comprises the the steps of training an SSAE network by using an intrusiondetection data set to obtain trained network flow data to be classified, and performing one-hot coding and standardization processing on the network flow data to be classified to obtain preprocessed network flow data; and inputting the preprocessed network flow data into a classifier based on an attention mechanism of the trained laminated sparse auto-encoder SSAE network, and carrying out classification processing on the network flow data to be classified by the classifier to obtain a network intrusion detection result of the network flow data to be classified. According to the method, a double-layer Bi-GRU network structure added with an attention mechanism is designed as a classifier, so that the method has relatively high classification accuracy and relatively low false alarm rate, andmeanwhile, the training and testing time of the model is greatly shortened.

Time sequence related network intrusion detection method based on attention mechanism

Handle everyday research tasks with reliable, citation-backed results

Your personal Research Agent to handle research tasks with citation-backed results

Popular Tasks used by Researchers

How can I help with your research?

Meet SciSpace

Get more enhanced response by uploading the PDFs you want me to reference.

No relevant PDFs in your library

SciSpace is the AI research assistant for academics. Run systematic literature reviews on 280M+ papers, and write papers with cited sources. Trusted by 1M+ students, PhDs & researchers.

SciSpace | AI for Research

Analyze PDFs

Code & Manuscripts

Funding & Grants

Literature & Patents

Medical & Clinical Data

Systematic Review

Visualize & Present

Web & Data

Build a Google Scholar-like website for your research.

Build a website

Create charts and images for your research

Create a Chart

Write a paper for submission to a journal

Draft a manuscript

Patent Search

Design eye-catching scientific posters in minutes.

Scientific Poster Generation

Systematic Literature Review

One task is running at the moment. Your messages will be shown right after.

Drag and drop or click here to browse

Loved by <highlight>1 million+</highlight> researchers

Extract a list of specific topics and their sources from unstructured text

Topics

Compare and analyze relevant papers that matches with your search

Papers

Get insights from PDFs and bookmarked papers from your library

My library

Recent searches

Try searching for:

Catch AI-generated content in scholarly and non-scholarly content

{ai} Detector

Ai Writer

Get PDF Summaries, highlighted text explanations 

Chat with PDF

Effortlessly create in-text citations and bibliographies in APA and 2,500 other formats

Citation generator

Get explanations, summaries, and answers on academic papers

Ease up your research workflow with {scispace}'s cohort of exciting AI tools

Elevate your academic writing skills and convey your ideas the way you want

Paraphraser

Explore our range of reading and writing tools

Your file is being prepared and should be ready in a few minutes. If it's a large file, it might take a bit longer. You can close this window, and we'll email you the file when it's done.

You have reached a maximum limit of <strong>{limit}</strong> columns in the table. Remove at least <strong>1</strong> column to add or create another one.

Jingyi Wang

Author Tools

Chat about Author

Papers

An Efficient Intrusion Detection Model Combined Bidirectional Gated Recurrent Units With Attention Mechanism

Time sequence related network intrusion detection method based on attention mechanism