<p>The rapid growth of connected devices has made networks more vulnerable to cyberattacks. While many existing intrusion detection methods have achieved significant results, they often face critical limitations. They often face critical limitations such as low generalization capability, sensitivity to imbalanced data, and high false positive rates. In this article, after thoroughly investigating previous Deep Learning (DL) approaches for intrusion detection, some approaches suffer from overfitting when applied to specific data distributions and lack scalability across diverse datasets. Others rely on computationally expensive feature selection techniques that may not adapt well to dynamic data environments. Some methods, such as GANs and heuristic optimization approaches, address data imbalance issues but can be resource-intensive. Hybrid models such as CNN+RNN and CNN+LSTM often operate as "black box" systems with limited interpretability, making decision-making less transparent. Moreover, many previous studies fail to address uncertainties, including sparse or incomplete training data. To overcome these challenges, in this paper, we propose a novel hybrid intrusion detection approach combining Fuzzy Rule Interpolation (FRI) reasoning and Deep Neural Networks (DNN). FRI’s reasoning engine effectively handles sparse rule issues and enhances adaptability, while the DNN provides high-performance classification. This combination was adapted by introducing the confidence-based fusion parameter. The DNN is used to predict probabilities for different classes, and the highest probability determines how confident the DNN is in its prediction. This confidence level is then used to calculate <InlineEquation ID="IEq1"> <EquationSource Format="TEX">\(\alpha \)</EquationSource> </InlineEquation>, which controls how much the final decision relies on the DNN versus an FRI. If the DNN is very confident, its prediction has more weight in the final output. From another perspective, if the DNN is less confident, the system leans more on the FRI. We tested and evaluated the proposed hybrid approach using nine benchmark intrusion datasets, covering various attacks such as IoT attacks, malware, multistep attacks, phishing, DoS, and DDoS. In binary and multi-class classification, and compared with the state-of-the-art approaches that use similar intrusion datasets, the results demonstrate the effectiveness of the suggested hybrid approach for detecting various types of intrusions.</p>

Confidence-Driven Hybrid Intrusion Detection: Combining Fuzzy Rule Interpolation and Deep Learning

期刊论文
发表日期：

2025年10月25日

查看全文

Mohammad Almseidin

摘要

The rapid growth of connected devices has made networks more vulnerable to cyberattacks. While many existing intrusion detection methods have achieved significant results, they often face critical limitations. They often face critical limitations such as low generalization capability, sensitivity to imbalanced data, and high false positive rates. In this article, after thoroughly investigating previous Deep Learning (DL) approaches for intrusion detection, some approaches suffer from overfitting when applied to specific data distributions and lack scalability across diverse datasets. Others rely on computationally expensive feature selection techniques that may not adapt well to dynamic data environments. Some methods, such as GANs and heuristic optimization approaches, address data imbalance issues but can be resource-intensive. Hybrid models such as CNN+RNN and CNN+LSTM often operate as "black box" systems with limited interpretability, making decision-making less transparent. Moreover, many previous studies fail to address uncertainties, including sparse or incomplete training data. To overcome these challenges, in this paper, we propose a novel hybrid intrusion detection approach combining Fuzzy Rule Interpolation (FRI) reasoning and Deep Neural Networks (DNN). FRI’s reasoning engine effectively handles sparse rule issues and enhances adaptability, while the DNN provides high-performance classification. This combination was adapted by introducing the confidence-based fusion parameter. The DNN is used to predict probabilities for different classes, and the highest probability determines how confident the DNN is in its prediction. This confidence level is then used to calculate \(\alpha \) , which controls how much the final decision relies on the DNN versus an FRI. If the DNN is very confident, its prediction has more weight in the final output. From another perspective, if the DNN is less confident, the system leans more on the FRI. We tested and evaluated the proposed hybrid approach using nine benchmark intrusion datasets, covering various attacks such as IoT attacks, malware, multistep attacks, phishing, DoS, and DDoS. In binary and multi-class classification, and compared with the state-of-the-art approaches that use similar intrusion datasets, the results demonstrate the effectiveness of the suggested hybrid approach for detecting various types of intrusions.