Reference Hub54
Evaluation of Recurrent Neural Network and its Variants for Intrusion Detection System (IDS)

Evaluation of Recurrent Neural Network and its Variants for Intrusion Detection System (IDS)

R Vinayakumar, K.P. Soman, Prabaharan Poornachandran
Copyright: © 2017 |Volume: 8 |Issue: 3 |Pages: 21
ISSN: 1947-8186|EISSN: 1947-8194|EISBN13: 9781522513797|DOI: 10.4018/IJISMD.2017070103
Cite Article Cite Article

MLA

Vinayakumar, R, et al. "Evaluation of Recurrent Neural Network and its Variants for Intrusion Detection System (IDS)." IJISMD vol.8, no.3 2017: pp.43-63. http://doi.org/10.4018/IJISMD.2017070103

APA

Vinayakumar, R., Soman, K., & Poornachandran, P. (2017). Evaluation of Recurrent Neural Network and its Variants for Intrusion Detection System (IDS). International Journal of Information System Modeling and Design (IJISMD), 8(3), 43-63. http://doi.org/10.4018/IJISMD.2017070103

Chicago

Vinayakumar, R, K.P. Soman, and Prabaharan Poornachandran. "Evaluation of Recurrent Neural Network and its Variants for Intrusion Detection System (IDS)," International Journal of Information System Modeling and Design (IJISMD) 8, no.3: 43-63. http://doi.org/10.4018/IJISMD.2017070103

Export Reference

Mendeley
Favorite Full-Issue Download

Abstract

This article describes how sequential data modeling is a relevant task in Cybersecurity. Sequences are attributed temporal characteristics either explicitly or implicitly. Recurrent neural networks (RNNs) are a subset of artificial neural networks (ANNs) which have appeared as a powerful, principle approach to learn dynamic temporal behaviors in an arbitrary length of large-scale sequence data. Furthermore, stacked recurrent neural networks (S-RNNs) have the potential to learn complex temporal behaviors quickly, including sparse representations. To leverage this, the authors model network traffic as a time series, particularly transmission control protocol / internet protocol (TCP/IP) packets in a predefined time range with a supervised learning method, using millions of known good and bad network connections. To find out the best architecture, the authors complete a comprehensive review of various RNN architectures with its network parameters and network structures. Ideally, as a test bed, they use the existing benchmark Defense Advanced Research Projects Agency / Knowledge Discovery and Data Mining (DARPA) / (KDD) Cup ‘99' intrusion detection (ID) contest data set to show the efficacy of these various RNN architectures. All the experiments of deep learning architectures are run up to 1000 epochs with a learning rate in the range [0.01-0.5] on a GPU-enabled TensorFlow and experiments of traditional machine learning algorithms are done using Scikit-learn. Experiments of families of RNN architecture achieved a low false positive rate in comparison to the traditional machine learning classifiers. The primary reason is that RNN architectures are able to store information for long-term dependencies over time-lags and to adjust with successive connection sequence information. In addition, the effectiveness of RNN architectures are shown for the UNSW-NB15 data set.

Request Access

You do not own this content. Please login to recommend this title to your institution's librarian or purchase it from the IGI Global bookstore.