Performance analysis and feature selection for network-based intrusion detection\rwith deep learning

Abstract

An intrusion detection system is an automated monitoring tool that analyzes network traffic and detects\rmalicious activities by looking out either for known patterns of attacks or for an anomaly. In this study, intrusion\rdetection and classification performances of different deep learning based systems are examined. For this purpose, 24\rdeep neural networks with four different architectures are trained and evaluated on CICIDS2017 dataset. Furthermore,\rthe best performing model is utilized to inspect raw network traffic features and rank them with respect to their\rcontributions to success rates. By selecting features with respect to their ranks, sets of varying size from 3 to 77 are\rassessed in terms of classification accuracy and time efficiency. The results show that recurrent neural networks with a\rcertain level of complexity can achieve comparable success rates with state-of-the-art systems using a small feature set\rof size 9; while the average time required to classify a test sample is halved compared to the complete set.