Researchers have proposed many approaches to detect intrusions based on machine learning techniques. This section reviews related work from the perspectives of anomaly analysis and feature analysis.
To address the problems of poor accuracy and feature engineering in intrusion detection, a traffic anomaly detection model known as BAT is proposed. The BLSTM (Bidirectional Long Short-Term Memory) attention mechanism developed by Su et al. [15] is incorporated into the BAT model. The packet vectors produced by the BLSTM model are fed into an attention mechanism, which then filters out irrelevant information in order to classify network traffic. To further hone in on the specifics of neighborhood-level traffic data, we employ many convolutional layers.Since the BAT model uses multiple convolutional layers to analyze data, they have given it the moniker BAT-MC. A softmax classifier can be used to sort the data flowing across a network. The suggested end-to-end model does not necessitate feature engineering knowledge and is capable of automatically identifying the most salient features of the hierarchy. It can improve anomaly detection and give an accurate representation of network traffic patterns. Through extensive experimental evaluation on a publicly available benchmark dataset, we demonstrate that our model significantly exceeds the current gold standard.
The problem was addressed by the Double-Layered Hybrid Strategy (DLHS) created by Wisanwanichthan and Thammawichai [16]. The research team behind this study used principal component analysis (PCA) to identify the variables that capture the most variation across all attack types, and they found that both R2L and U2R attacks behave similarly to typical users. DLHA employs a Naive Bayes classifier at Layer 1 for detecting DoS and Probe, and an SVM at Layer 2 for distinguishing R2L and U2R from chance occurrences.We compared our findings to those of previous research studies using the NSL-KDD dataset. Experiment results suggest that DLHA is more effective than both state-of-the-art IDS approaches and individual machine learning classifiers. DLHA has an exceptional ability to detect exceedingly rare strikes, with a detection rate of 96.67 percent from R2L and a perfect rate from U2R.Using an ensemble unsupervised ML method, Das et al.[17] develop an intrusion detection system capable of identifying DDoS attacks with exceptional accuracy. In order to better detect DDoS attacks, this research focuses on decreasing the frequency of false positives. To compare the efficacy of our ensemble to that of our individual models and other preceding models, they undertake trials with the NSL-KDD dataset and twelve feature sets from prior research.
By integrating a Deep Neural Network (DNN) and a well-posed stacking sparse AutoEncoder (AE) for feature learning, Bhardwaj et al.[18] present a new architecture for categorizing network traffic into benign traffic and DDoS assault traffic. AE and DNN can be optimized for detecting DDoS assaults by fine-tuning the settings with purpose-built algorithms.Reconstruction errors can be minimized, and exploding and disappearing gradients can be prevented, and overfitting can be avoided by employing a smaller network. The suggested method was compared to ten state-of-the-art algorithms using detection accuracy, precision, recall, and F1-Score. The CICIDS2017 and NSL-KDD benchmark datasets were used in a series of experimental validations. Compared to state-of-the-art methods, the suggested method performs better on the NSL-KDD dataset and achieves results that are competitive with state-of-the-art methods on the CICIDS2017 dataset.
The NSL-KDD dataset is analyzed by Liu et al. [19] for attacks on sensor nodes and networks in IoT settings. In addition, the effectiveness of eleven machine learning algorithms in recognizing the artificial attacks are reported .With the help of numerical analysis, is shown that tree-based and ensemble methods are far superior to the other machine learning approaches were looked into. XGBoost outperforms all other supervised algorithms with its 97% accuracy, 90% Matthews correlation coefficient (MCC), and 99.6% Area Under the Curve (AUC) performance. The unsupervised Expectation-Maximization (EM) technique may be able to detect assaults in the NSL-KDD dataset with an accuracy that is 22.0 percentage points greater than that of the Naive Bayes classifier; this is another intriguing conclusion drawn from this work.
Combining techniques like J48, Naive Bayes, Random Tree, and NB-Tree, Aljawarneh et al. [20] used many different types of datasets. All analyses were performed on data acquired during an NSL KDD incursion. The data was divided into a training set and a test set based on the analysis performed on it.The effectiveness of each feature was then evaluated using a WEKA-based feature selection technique. According to the collected data, this algorithm outperformed the feature selection method with more precision and efficiency without employing the targeted features.Using a 10-fold cross-validation test, this system achieved a detection accuracy of 99.88% across all features, 90.01% across all features when employing the complete test datasets, and 76.23% across all features while employing the test-21 dataset.
The Condensed Nearest Neighbors (CNN) method was used by Belgrana et al. [21]. This approach excels at classification and regression due to its consideration of sample dispersion. CNN's use of dimensionality reduction techniques reduces the load on the system and speeds up the detection process without sacrificing accuracy.The next approach involved using a Neural Network (NN) to learn from our dataset after we had first pre-classified it. We provide a contrast to K Nearest Neighbors (KNN) methods to show how effective our approaches are. As an added bonus, reserchers compared methods to two other options in the WEKA program.The empirical results show that the two proposed approaches for IDS improve the detection rate, decrease the number of missed attacks, and shorten the processing time all at the same time. Several ML approaches, including DT, RF, NB, K-NN Classifier, and other DL models, including CNN and ANN models, were utilized to automate the identification of the incursion by Iyer et al.[22]. However, Ugwu et al. [23] presented a deep learning system based on LSTM that can identify DDoS attacks. The proposed model was evaluated on the UNSW-NB15 and NSL-KDD intrusion datasets by extracting 23 and 20 attack features, respectively, using singular value decomposition (SVD).
The Deep Learning Model for Network Intrusion Detection was presented by Fu et al.[24] as a means of identifying traffic irregularities (DLNID). To efficiently extract sequence properties from data flow, this model makes use of the bidirectional long short-term memory (Bi-LSTM) network and an attention mechanism.In order to extract sequence features, the suggested method first makes use of a convolutional neural network (CNN) network, and then uses an attention mechanism to redistribute weights among the channels. Finally, the Bi-LSTM network is used to acquire knowledge about the sequence feature network. Large discrepancies can be seen in many publicly available intrusion detection datasets. Using the adaptive synthetic sampling (ADASYN) method, this research equalizes the data by increasing the sample size of underrepresented groups.To further aid data compression and integration, a tweaked stacking autoencoder is used. Because it does away with the requirement for human intervention in the feature extraction process, the DLNID model is presented as a comprehensive answer. The experimental results show that when tested on the public benchmark dataset for network intrusion detection NSL-KDD, this model achieves higher accuracy and F1 score than competing approaches.
In most cases, models and algorithms can only get rather close to the limits of machine learning, which are set by the data and features themselves. So, feature selection is crucial in machine learning. Datasets with tens of thousands of dimensions of feature space are becoming increasingly common as computing power is applied across more and more areas of human society. However, only a subset of characteristics can adequately capture the essence of things. The efficiency of deep learning algorithms is severely hindered because this subset of data is masked by an overwhelming quantity of irrelevant and duplicate features. So far, scientists have successfully integrated feature selection with deep learning, and the practice has seen extensive use in sectors like network traffic monitoring and security.