The network intrusion detection schemes based on traditional deep learning have poor performance for unknown intrusion and fast varying network environments. These schemes usually use single-layer model or multi-layer model. The single-layer model focus on one type of features in the network traffic, ignoring part of the space and sequential features. While the multi-layer model has complicated structure and prevent its capability to extract the features by neural network. In this paper, we propose a multi-layer feature learning model based on one-dimensional fully convolutional neural network (1D FCN) and Transformer, where the 1D FCN is used to extract the local feature, and multiple Transformer encoders are used to extract the global feature of the network traffic. The proposed model not only efficiently extract the space-time features of network traffic, but also accelerates the training using parallel Transformer encoders. Experiment results show that the proposed model achieves the best performance among CNN-BiLSTM, CNN-BiGRU-Attn and Transformer models.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

A Network Intrusion Detection Algorithm Based on Multi-layer Feature Learning

  • Shiwei Tang,
  • Zhilong Li,
  • Yizhen Lu,
  • Xiaoyu Yang,
  • Shigang Tang,
  • Guangqiang Yin

摘要

The network intrusion detection schemes based on traditional deep learning have poor performance for unknown intrusion and fast varying network environments. These schemes usually use single-layer model or multi-layer model. The single-layer model focus on one type of features in the network traffic, ignoring part of the space and sequential features. While the multi-layer model has complicated structure and prevent its capability to extract the features by neural network. In this paper, we propose a multi-layer feature learning model based on one-dimensional fully convolutional neural network (1D FCN) and Transformer, where the 1D FCN is used to extract the local feature, and multiple Transformer encoders are used to extract the global feature of the network traffic. The proposed model not only efficiently extract the space-time features of network traffic, but also accelerates the training using parallel Transformer encoders. Experiment results show that the proposed model achieves the best performance among CNN-BiLSTM, CNN-BiGRU-Attn and Transformer models.