Source-linked AI summary
Shallow and Deep Networks Intrusion Detection System: A Taxonomy and Survey
Elike Hodo, Xavier Bellekens, Andrew Hamilton, Christos Tachtatzis, Robert Atkinson
TL;DR
Reliable IDS must handle large, changing data while limiting false alarms and detecting attacks beyond known signatures. This paper classifies IDS and surveys shallow and deep network approaches, machine-learning techniques, feature selection, and reported performance. It synthesizes prior studies to clarify IDS taxonomy, complexity, and performance considerations for developing reliable machine-learning-based systems.
Problem
IDS research still faces the challenge of handling large quantities of changing data while achieving high detection accuracy, low false-alarm rates, and detection of unknown attacks.
Method
The paper presents an IDS classification and taxonomy, surveys shallow and deep network IDS and machine-learning techniques, and compares results from existing studies.
Results
The survey reviews detection approaches and their reported performance, including time-series models that forecast attacks and a GARMA model reported as better for attack detection than ARMA.
Takeaways & Limitations
The taxonomy organizes IDS by data source and detection technique, providing guidelines for understanding their complexity and comparing machine-learning approaches.
Takeaways & Limitations
Rule-based anomaly detection can fail to detect threats that are not programmed as system rules, while signature-based IDS are vulnerable to unknown attacks.
Abstract
from arXiv · showhide
Intrusion detection has attracted a considerable interest from researchers and industries. The community, after many years of research, still faces the problem of building reliable and efficient IDS that are capable of handling large quantities of data, with changing patterns in real time situations. The work presented in this manuscript classifies intrusion detection systems (IDS). Moreover, a taxonomy and survey of shallow and deep networks intrusion detection systems is presented based on previous and current works. This taxonomy and survey reviews machine learning techniques and their performance in detecting anomalies. Feature selection which influences the effectiveness of machine learning (ML) IDS is discussed to explain the role of feature selection in the classification and training phase of ML IDS. Finally, a discussion of the false and true positive alarm rates is presented to help researchers model reliable and efficient machine learning based intrusion detection systems.
1.0 INTRODUCTION
The introduction frames IDS as necessary for increasingly network-dependent systems but highlights false alarms, unknown attacks, and throughput limitations. The paper responds with a taxonomy and survey comparing shallow and deep learning IDS, detection approaches, and reviewed performance.
- Networks increasingly support critical activities, making IDS important for detecting threats from internal and external intruders.
- Existing IDS struggle with false positive and false negative alarms, low detection accuracy, and attacks that lack known signatures.
- Machine-learning IDS learn from normal and abnormal traffic, but some implementations report low throughput and high false detection rates.
- The paper develops a taxonomy to describe IDS diversity and complexity, including host- or network-based data sources and anomaly- or signature-based techniques.
- The manuscript surveys and compares shallow and deep network IDS, machine-learning techniques, and performance metrics from existing studies.
- Reviewed examples span statistical, time-series, rule-based, expert-system, string-matching, Markov, and other detection models.
- The RIPPER rule, C5, and SVM experiments recorded total detection rates of 98.69%, 98.75%, and 98.63%, respectively.
M. Ali Alheeti et al. [60]
The section surveys machine-learning techniques for intrusion detection, emphasizing feature extraction, classification capabilities, and comparative performance. It covers Bayesian networks, nearest-neighbor, decision-tree, and clustering approaches alongside feature-selection and dataset considerations.
- IDS feature selection: Machine-learning classification uses training to learn feature distributions and classification to apply the learned normal profile for detecting abnormalities.The process includes normalization, noise removal, and feature extraction before classification.
- IDS feature selection: Machine-learning IDS effectiveness depends on training data quality and selecting informative features from raw network data.Training data should include normal and abnormal patterns, while extracted features influence classification and detection.
- Bayesian networks: Bayesian networks achieved 97.27% accuracy with a 0.008 false positive rate on NSL-KDD after reducing 41 features to 16.The reported accuracy exceeded Naïve Bayes, K-means clustering, decision stump, and RBF network baselines in that experiment.
- Decision trees: Decision trees classify data through attribute-based nodes and leaves; a J48 model classified 97.23% of Kyoto 2006+ records correctly.The dataset included normal traffic, known attacks, and unknown attacks.
- Clustering: K-means IDS clustering groups unlabeled data by minimizing within-cluster distance and maximizing between-cluster distance.An improved version automatically adjusted cluster counts and reported a 90% detection rate with a 15% false positive rate on KDD Cup’99.
S. Akbar et al. [112] 2012
The cited study is listed among machine-learning intrusion-detection works, while the survey notes that most such evaluations use benchmark datasets rather than real network data.
- Evaluation scope: Most machine-learning intrusion-detection studies evaluated KDDCup99 or NSL-KDD, whereas only two recent studies tested real network data.The survey identifies this dataset imbalance in its comparison of prior work.
3.5 Binary Classification metrics
Binary classification metrics use confusion-matrix outcomes to evaluate ML intrusion-detection predictions. Detection rate measures correctly classified examples relative to test examples.
- Confusion-matrix outcomes are True Negative, True Positive, False Positive, and False Negative classifications.TN counts normal events correctly classified; TP counts attacks correctly classified; FP counts normal events misclassified as attacks; FN counts attacks misclassified as normal.
- The section presents basic metrics used to calculate ML IDS performance.
- Detection rate is the number of correctly classified data examples divided by the test examples.
4.0 ARTIFICIAL NEURAL NETWORK AND DEEP NETWORKS IDS
This section reviews artificial neural networks and deep learning as computational-intelligence approaches for detecting attacks.
- Artificial neural networks and deep learning use computational intelligence to detect attacks.
4.1 Artificial Neural Network
The paper surveys supervised and unsupervised neural-network approaches for intrusion detection, including MLP, RBF, SOM, and ART. Reported comparisons show varied trade-offs, with hybrid ANN approaches summarized as most suitable across several criteria.
- Artificial Neural Network: Artificial neural networks are information-processing elements modeled after brain neurons and categorized into supervised and unsupervised learning.
- Supervised Learning: Supervised neural networks learn mappings from inputs x to outputs y using labelled input-output training pairs.The training set d contains N examples, with categorical labels y_i∈{1 … C}.
- Supervised Learning: MLP is a feedforward network with hidden layers trained commonly by back propagation to classify normal and attack outputs.Additional nonlinear stages form more complex hypotheses, while scalar connection weights are adjusted during training.
- Supervised Learning: 99.2% detection rate and 1.2% false positive rate were reported for RBF, compared with 93.7% and 7.2% for MLP-BP on KDD Cup’99.The comparison used four attack types, with 1000 training and 1000 testing records containing 34 numerical and 7 symbolic features.
- Supervised Learning: RBF performed similarly to BPL for misuse detection, trained faster, and outperformed BPL for anomaly detection in one KDD Cup’99 study.The anomaly-detection comparison required manual output-threshold adjustment for BPL, while RBF required decision-threshold adjustment.
- Unsupervised Learning: Unsupervised networks discover patterns from unlabelled inputs; typical approaches include SOMs and ART.SOMs map inputs into two-dimensional feature maps and group inputs by similarity, while ART includes unsupervised and hybrid supervised variants.
- Unsupervised Learning: 96.13% detection rate and 3.86% false alarm rate were reported for a PCA-fuzzy-ART anomaly-detection method on KDD Cup’99.
- Summary: MLP-BP exceeded SOM and ART on several detection, false-alarm, time-saving, and cost-effectiveness criteria, while SOM was better for lower overhead and coordinated or varied intrusions.
4.2 Deep Networks
Deep-network IDS use hierarchical, generative, recurrent, and convolutional architectures for intrusion classification. Reported studies show strong performance, while training strategy and architecture shape their practical use.
- Deep-network overview: Deep networks classify data through many hierarchical layers, commonly using unsupervised learning during training.Their development includes Deep Belief Networks trained layer by layer with unsupervised Restricted Boltzmann Machines.
- Recurrent architecture: 96.93% accuracy and a 98.88% detection rate were reported for an LSTM-RNN trained on KDD Cup ’99 data.The study described its false alarm rate as slightly higher than other classifiers but judged its overall performance best.
- Auto-encoder architecture: Deep auto-encoders use bottleneck layers to transform and reconstruct inputs, while greedy layer-wise pre-training addresses backpropagation difficulties.The reviewed NSL-KDD approach using bottleneck features outperformed PCA, factor analysis, and Kernel/PCA in accuracy.
- Generative architecture: DBNs combine unsupervised pre-training with supervised fine-tuning, stacking RBMs with additional discriminative layers.RBMs learn joint distributions of training data without labels before fine-tuning supports classification.
- Generative architecture: 93.49% accuracy, 92.33 TP, and 0.76% FP were reported for a DBN classifier on KDD data.A separate NSL-KDD experiment reported 97.5% accuracy for identifying unknown attacks, outperforming DBN-SVM and SVM classifiers.
- Discriminative architecture: CNNs use convolutional and pooling layers followed by fully connected layers, sharing weights and reducing parameters relative to similarly connected networks.Pooling reduces system dimensionality and introduces variation to the input representation.
5.0 Conclusion
The paper surveys and classifies shallow and deep-network IDS, including machine-learning methods, anomaly-detection performance, and system complexity. It concludes that research is still exploring reliable and efficient approaches, particularly for knowledge-based and behavioral detection.
- Conclusion: The paper reviews IDS classifications, taxonomies, shallow and deep networks, anomaly-detection methods, and their reported advantages and disadvantages.Its scope includes single and hybrid machine-learning techniques and performance metrics.
- Conclusion: Research remains in progress to test the reliability and efficiency of knowledge-based and behavioral intrusion-detection approaches.The conclusion frames these approaches as active areas of experimentation rather than settled solutions.