An LSTM-based intrusion detection model utilizing feature selection and dropout
TL;DR
This approach is particularly effective at detecting minority attack types, especially Web attack and Bot, in the multi-class classification, and outperforms traditional methods such as convolutional neural network (CNN), Logistic Regression, and Bayesian models in binary as well as multi-class classification tasks.
Abstract
With the advancement of network technology, cybersecurity concerns have intensified, as intrusions pose significant risks to both individuals and organizations. In order to solve the problem of low detection accuracy and high false alarm rate caused by redundant features in network traffic data, a new model is thus developed in this study for intrusion detection that employs Long Short-Term Memory (LSTM) networks to learn the temporal attributes of network traffic data, complemented by feature selection and dropout techniques, to enhance detection accuracy. The approach begins by applying the eXtreme Gradient Boosting (XGBoost) algorithm for feature selection on network traffic data, reducing feature redundancy. Consequently, the most relevant features are identified for effective classification. The selected features undergo preprocessing through one-hot encoding and normalization before being input into the LSTM network for training. To enhance performance, dropout is employed to minimize overfitting and boost generalization. When tested on the CICIDS2017, the model outperforms traditional methods such as convolutional neural network (CNN), Logistic Regression, and Bayesian models in binary as well as multi-class classification tasks. Significantly, this approach is particularly effective at detecting minority attack types, especially Web attack and Bot, in the multi-class classification.