Survey of Network Intrusion Detection Based on Deep Learning

Abstract

Abstract: The rapid development of the Internet not only brings great convenience to users, but also causes many security incidents. With the increasing number of network attacks such as zeroday vulnerabilities and encryption attacks, the network security situation is becoming more and more serious. Intrusion detection is an important means of network attack detection. In recent years, with the continuous development of deep learning technology, intrusion detection system based on deep learning is gradually becoming a research hotspot in the field of network security. This paper introduces recent work on network intrusion detection using deep learning technology based on extensive investigation of literature. Firstly, it briefly summarizes the current network security situation and traditional intrusion detection technologies. Then, several deep learning models commonly used in network intrusion detection system are introduced. Then it summarizes the commonly used data preprocessing techniques, data sets and evaluation indicators in deep learning. Then from the perspective of practical application, it introduces the specific application of deep learning model in network intrusion detection system. Finally, the problems in the current research process are discussed, and the future development direction is put forward.

Key words: cyber security, network attack, intrusion detection, network intrusion detection system, deep learning

摘要： 互联网的迅速发展在给用户带来巨大便利的同时，也引发了诸多安全事故.随着零日漏洞、加密攻击等网络攻击行为日益增加，网络安全形势愈发严峻.入侵检测是网络攻击检测的一种重要手段.近年来，随着深度学习技术的持续发展，基于深度学习的入侵检测系统逐渐成为网络安全领域的研究热点.通过对文献的广泛调查，介绍了利用深度学习技术进行网络入侵检测的最新工作.首先，对当前网络安全形势及传统入侵检测技术进行简要概括；然后，介绍了网络入侵检测系统中常用的几种深度学习模型；接着，总结了深度学习中常用的数据预处理技术、数据集以及评价指标；再从实际应用的角度介绍了深度学习模型在网络入侵检测系统中的具体应用；最后，讨论了目前研究过程中面临的问题，提出了未来的发展方向.

关键词: 网络安全, 网络攻击, 入侵检测, 网络入侵检测系统, 深度学习

黄屿璁, 张潮, 吕鑫, 曾涛, 王鑫元, 丁辰龙, . 基于深度学习的网络入侵检测研究综述[J]. 信息安全研究, 2022, 8(12): 1163-.

References

［1］张赛男, 孙彪. 基于机器学习的网络异常检测方法综述［J］. 吉林大学学报: 信息科学版, 2021, 39(6): 732742［2］Liu H, Lang B. Machine learning and deep learning methods for intrusion detection systems: A survey［J］. Applied Sciences, 2019, 9(20): 43964396［3］Chamou D, Toupas P, Ketzaki E, et al. Intrusion detection system based on network traffic using deep neural networks［C］ Proc of the 24th Int Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD). Piscataway, NJ: IEEE, 2019: 16［4］Otter D W, Medina J R, Kalita J K. A survey of the usages of deep learning for natural language processing［J］. IEEE Trans on Neural Networks and Learning Systems, 2019, 32(2): 604624［5］Almiani M, AbuGhazleh A, AlRahayfeh A, et al. Deep recurrent neural network for IoT intrusion detection system［EBOL］. ［20220402］. https:www.researchgate.netpublication337492444_Deep_Recurrent_Neural_Network_For_IoT_Intrusion_Detection_System［6］Kingma D P, Welling M. Stochastic gradient VB and the variational autoencoder［EBOL］. (20140501) ［20220402］. https:arxiv.orgabs1312.6114v7［7］Duan T, Tian Y, Zhang H, et al. Intelligent processing of intrusion detection data［J］. IEEE Access, 2020, 8(4): 7833078342［8］Yang Y, Zheng K, Wu C, et al. Building an effective intrusion detection system using the modified density peak clustering algorithm and deep belief networks［J］. Applied Sciences, 2019, 9(2): 125［9］唐贤伦, 杜一铭, 刘雨微, 等. 基于条件深度卷积生成对抗网络的图像识别方法［J］. 自动化学报, 2018, 44(5): 855864［10］Gumusbas D, Yldrm T, Genovese A, et al. A comprehensive survey of databases and deep learning methods for cybersecurity and intrusion detection systems［J］. IEEE Systems Journal, 2021, 15(2): 17171731［11］Hu Z, Wang L, Qi L, et al. A novel wireless network intrusion detection method based on adaptive synthetic sampling and an improved convolutional neural network［J］. IEEE Access, 2020, 8(10): 195741195751［12］产院东, 郭乔进, 梁中岩, 等. 基于深度学习的入侵检测综述［J］. 信息化研究, 2021, 47(4): 17［13］蹇诗婕, 卢志刚, 杜丹, 等. 网络入侵检测技术综述［J］. 信息安全学报, 2020, 5(4): 96122［14］Genovese A, Piuri V, Plataniotis K N, et al. PalmNet: GaborPCA convolutional networks for touchless palmprint recognition［J］. IEEE Trans on Information Forensics and Security, 2019, 14(12): 31603174［15］Shibahara T, Yagi T, Akiyama M, et al. Efficient dynamic malware analysis based on network behavior using deep learning［C］ Proc of the 2016 IEEE Global Communications Conf(GLOBECOM). Piscataway, NJ: IEEE, 2016: 17［16］David O E, Netanyahu N S. Deepsign: Deep learning for automatic malware signature generation and classification［C］ Proc of the 2015 Int Joint Conf Neural Networks (IJCNN). Piscataway, NJ: IEEE, 2015: 18［17］Wang X, Yiu S M. A multitask learning model for malware classification with useful file access pattern from API call sequence［EBOL］. ［20220402］. https:www.researchgate.netpublication309288495_A_multitask_learning_model_for_malware_classification_with_useful_file_access_pattern_from_API_call_sequence［18］YousefiAzar M, Varadharajan V, Hamey L, et al. Autoencoderbased feature learning for cyber security applications［C］ Proc of the 2017 Int Joint Conf Neural Networks (IJCNN). Piscataway, NJ: IEEE, 2017: 38543861［19］Anderson H S, Woodbridge J, Filar B. DeepDGA: Adversariallytuned domain generation and detection［C］ Proc of the 2016 ACM Workshop on Artificial Intelligence and Security. New York: ACM, 2016: 1321［20］Woodbridge J, Anderson H S, Ahuja A, et al. Predicting domain generation algorithms with long shortterm memory networks［EBOL］. ［20220402］. http:www.covert.ioresearchpapersdeeplearningsecurityPredicting%20Domain%20Generation%20Algorithms%20with%20Long%20ShortTerm%20Memory%20Networks.pdf［21］Zeng F, Chang S, Wan X. Classification for DGAbased malicious domain names with deep learning architectures［J］. International Journal of Intelligent Information Systems, 2017, 6(6): 6771［22］Mac H, Tran D, Tong V, et al. DGA botnet detection using supervised learning methods［C］ Proc of the 8th Int Symp on Information and Communication Technology. New York: ACM, 2017: 211218［23］Nasr M, Bahramali A, Houmansadr A. Deepcorr: Strong flow correlation attacks on TOR using deep learning［C］ Proc of the 2018 ACM SIGSAC Conf on Computer and Communications Security. New York: ACM, 2018: 19621976［24］Jiang J, Chen J, Choo K R, et al. A deep learning based online malicious URL and DNS detection scheme［G］ SecureComm 2017: Security and Privacy in Communication Networks. Berlin: Springer, 2017: 438448［25］Khan R U, Zhang X, Alazab M, et al. An improved convolutional neural network model for intrusion detection in networks［C］ Proc of 2019 Cybersecurity and Cyberforensics Conf(CCC). Piscataway, NJ: IEEE, 2019: 7477［26］Andresini G, Appice A, Malerba D. Nearest clusterbased intrusion detection through convolutional neural networks［EBOL］. (20210315) ［20220402］. https:www.sciencedirect.comsciencearticleabspiiS0950705121000617［27］Shibahara T, Yamanishi K, Takata Y, et al. Malicious URL sequence detection using event denoising convolutional neural network［C］ Proc of the 2017 IEEE Int Conf Communications (ICC). Piscataway, NJ: IEEE, 2017: 17［28］Suda H, Natsui M, Hanyu T. Systematic intrusion detection technique for an invehicle network based on timeseries feature extraction［C］ Proc of the 48th IEEE Int Symp on MultipleValued Logic (ISMVL). Piscataway, NJ: IEEE, 2018: 5661［29］燕昺昊, 韩国栋. 基于深度循环神经网络和改进SMOTE算法的组合式入侵检测模型［J］. 网络与信息安全学报, 2018, 4(7): 4859［30］Hou H, Xu Y, Chen M, et al. Hierarchical long shortterm memory network for cyberattack detection［J］. IEEE Access, 2020, 8(3): 9090790913［31］Roy B, Cheung H. A deep learning approach for intrusion detection in Internet of things using bidirectional long shortterm memory recurrent neural network［C］ Proc of the 28th Int Telecommunication Networks and Applications Conf. Piscataway, NJ: IEEE, 2018: 16［32］Alkadi O, Moustafa N, Turnbull B, et al. A deep blockchain frameworkenabled collaborative intrusion detection for protecting IoT and cloud networks［J］. IEEE Internet of Things Journal, 2020, 8(12): 94639472［33］Mahdavisharif M, Jamali S, Fotohi R. Big dataaware intrusion detection system in communication networks: A deep learning approach［J］. Journal of Grid Computing, 2021, 19(4): 1946［34］Farahnakian F, Heikkonen J. A deep autoencoder based approach for intrusion detection system［C］ Proc of the 20th Int Conf on Advanced Communication Technology (ICACT). Piscataway, NJ: IEEE, 2018: 178183［35］Li X, Chen W, Zhang Q, et al. Building autoencoder intrusion detection system based on random forest feature selection［EBOL］. ［20220402］. https:www.sciencedirect.comsciencearticlepiiS0167404820301231［36］Zavrak S, skefiyeli M. Anomalybased intrusion detection from network flow features using variational autoencoder［J］. IEEE Access, 2020, 8(6): 108346108358［37］Yu Y, Long J, Cai Z. Network intrusion detection through stacking dilated convolutional autoencoders［J］. Security and Communication Networks, 2017, 2017(11): 110［38］Gao N, Gao L, Gao Q, et al. An intrusion detection model based on deep belief networks［C］ Proc of the 2nd Int Conf Advanced Cloud and Big Data (CBD). Piscataway, NJ: IEEE, 2014: 247252［39］Alrawashdeh K, Purdy C. Toward an online anomaly intrusion detection system based on deep learning［C］ Proc of the 15th IEEE Int Conf Machine Learning and Applications (ICMLA). Piscataway, NJ: IEEE, 2015: 195200［40］Chawla S. Deep learning based intrusion detection system for Internet of things［D］. Seattle: University of Washington, 2017［41］Singla A, Bertino E, Verma D. Preparing network intrusion detection deep learning models with minimal data using adversarial domain adaptation［C］ Proc of the 15th ACM Asia Conf on Computer and Communications Security. New York: ACM, 2020: 127140［42］Liu X, Li T, Zhang R, et al. A GAN and feature selectionbased oversampling technique for intrusion detection［J］. Security and Communication Networks, 2021, 2021(7): 115［43］肖建平, 龙春, 赵静, 等. 基于深度学习的网络入侵检测研究综述［J］. 数据与计算发展前沿, 2021, 3(3): 5974［44］张小莉, 程光, 张慰慈. 基于改进深度卷积神经网络的网络流量分类方法［J］. 中国科学: 信息科学, 2021, 51(1): 5674［45］Yin C, Zhu Y, Fei J, et al. A deep learning approach for intrusion detection using recurrent neural networks［J］. IEEE Access, 2017, 5(10): 2195421961［46］Xiao Y, Xing C, Zhang T, et al. An intrusion detection model based on feature reduction and convolutional neural networks［J］. IEEE Access, 2019, 7(3): 4221042219［47］Kannari P R, Shariff N C, Biradar R L. Network intrusion detection using sparse autoencoder with SwishPReLU activation model［EBOL］. (20210313) ［20220402］. https:link.springer.comarticle10.1007s12652021030770［48］Aldwairi T, Perera D, Novotny M A. An evaluation of the performance of restricted boltzmann machines as a model for anomaly network intrusion detection［J］. Computer Networks, 2018, 144(10): 111119［49］Elsaeidy A, Munasinghe K S, Sharma D, et al. Intrusion detection in smart cities using restricted boltzmann machines［J］. Journal of Network and Computer Applications, 2019, 135(6): 7683［50］Thamilarasu G, Chawla S. Towards deeplearningdriven intrusion detection for the Internet of things［J］. Sensors, 2019, 19(9): 119［51］Lin Z, Shi Y, Xue Z. IDSGAN: Generative adversarial networks for attack generation against intrusion detection［J］. arXiv preprint, arXiv:1809.02077, 2018［52］Liao D, Huang S, Tan Y, et al. Network intrusion detection method based model GAN［C］ Proc of the 2020 Int Conf on Computer Communication and Network Security (CCNS). Piscataway, NJ: IEEE, 2020: 153156［53］张昊, 张小雨, 张振友, 等. 基于深度学习的入侵检测模型综述［J］. 计算机工程与应用, 2022, 58(6): 1728［54］彭祯方, 邢国强, 陈兴跃. 人工智能在网络安全领域的应用及技术综述［J］. 信息安全研究, 2022, 8(2): 110116

[1]	. [J]. Journal of Information Security Reserach, 2022, 8(8): 793-.
[2]	. Design and Implementation of Anomaly Detection System for Programmable Data Plane System [J]. Journal of Information Security Reserach, 2022, 8(2): 135-.
[3]	. Cloud Host Security Management Platform Construction [J]. Journal of Information Security Reserach, 2021, 7(E1): 58-.
[4]	. Topsec Industrial Intrusion Detection and Audit System [J]. Journal of Information Security Reserach, 2021, 7(E1): 67-.
[5]	. NetSensor Network Traffic Analysis Solution [J]. Journal of Information Security Reserach, 2021, 7(E1): 126-.
[6]	. Research on Host Intrusion Fetection Method Based on System Call Behavior Similarity Clustering [J]. Journal of Information Security Reserach, 2021, 7(9): 828-835.
[7]	. Design of the standard architecture of the network security situation awareness [J]. Journal of Information Security Reserach, 2021, 7(9): 844-848.
[8]	. Research Progress and Challenge of Advanced Persistent Threat and Its Reconstruction [J]. Journal of Information Security Reserach, 2021, 7(6): 512-519.
[9]	. Research on Intrusion Detection Model based on Multiple Feature Selection Strategies [J]. Journal of Information Security Research, 2021, 7(3): 225-232.
[10]	. Phishing Email Analysis of Social Engineering Attacks [J]. Journal of Information Security Research, 2021, 7(2): 166-170.
[11]	. An Analysis of SDN Attack and Defense Technology [J]. Journal of Information Security Research, 2019, 5(4): 333-339.
[12]	. Network Intrusion Detection System Model Based on LightGBM [J]. Journal of Information Security Research, 2019, 5(2): 152-156.
[13]	. Summary of Mobile Payment Security Technology [J]. Journal of Information Security Research, 2019, 5(10): 944-952.
[14]	. Research of the Scenes in the Cyberspace Game [J]. Journal of Information Security Research, 2018, 4(5): 415-419.
[15]	. Network Intrusion Detection Method Based on Data Mining [J]. Journal of Information Security Research, 2017, 3(9): 810-816.