Intrusion Detection System, a New Approach to R2L and U2R Attack Classification

Intrusion detection systems have played and will continue to play an essential role in detecting network attacks and anomalies. Numerous authors have investigated the use of neural networks to accomplish this objective. Most existing models proposed in the literature struggle to detect various attack types, especially User-to-Root (U2R) and Remote-to-Local (R2L) attacks. The current models appear to be less accurate at detecting these two types of attacks. Consequently, we propose in this paper a detection technique based on feature selection and Long-Short-Term-Memory (LSTM) to address the challenges. Using the Shap values feature selection method, each class of attacks’ NSLKDD attacks dataset features are reduced. Then, with the reduced feature set, LSTM is performed for record classification. The NSL-KDD dataset is utilized to train and assess the performance of our model. In terms of accuracy, precision, recall, and F-score values, it outperforms LSTM with all features and other state-of-the-art models. In addition, our model provides a more accurate classification of R2L (Remote-to-Local) and U2R (User-to-Root) attacks.