Early Detection of Network Intrusions Using a GAN-Based One-Class Classifier
Early detection of network intrusions is a very important factor in network security. However, most studies of network intrusion detection systems utilize features for full sessions, making it difficult to detect intrusions before a session ends. To solve this problem, the proposed method uses packe...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2022-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9945961/ |
| _version_ | 1798017534573674496 |
|---|---|
| author | Taehoon Kim Wooguil Pak |
| author_facet | Taehoon Kim Wooguil Pak |
| author_sort | Taehoon Kim |
| collection | DOAJ |
| description | Early detection of network intrusions is a very important factor in network security. However, most studies of network intrusion detection systems utilize features for full sessions, making it difficult to detect intrusions before a session ends. To solve this problem, the proposed method uses packet data for features to determine if packets are malicious traffic. Such an approach inevitably increases the probability of falsely detecting normal packets as an intrusion or an intrusion as normal traffic for the initial session. As a solution, the proposed method learns the patterns of packets that are unhelpful in order to classify network intrusions and benign sessions. To this end, a new training dataset for Generative Adversarial Network (GAN) is created using misclassified data from an original training dataset by the LSTM-DNN model trained using the original one. The GAN trained with this dataset has ability to determine whether the currently received packet can be accurately classified in the LSTM-DNN. If the GAN determines that the packet cannot be classified correctly, the detection process is canceled and will be tried again when the next packet is received. Meticulously designed classification algorithm based on LSTM-DNN and validation model using GAN enable the proposed algorithm to accurately perform network intrusion detection in real time without session termination or delay time for collecting a certain number of packets. Various experiments confirm that the proposed method can detect intrusions very early (before the end of the session) while maintaining detection performance at a level similar to that of the existing methods. |
| first_indexed | 2024-04-11T16:08:53Z |
| format | Article |
| id | doaj.art-c79eca492ff54da0bb0215cbe985a2e4 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-04-11T16:08:53Z |
| publishDate | 2022-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-c79eca492ff54da0bb0215cbe985a2e42022-12-22T04:14:45ZengIEEEIEEE Access2169-35362022-01-011011935711936710.1109/ACCESS.2022.32214009945961Early Detection of Network Intrusions Using a GAN-Based One-Class ClassifierTaehoon Kim0https://orcid.org/0000-0001-6087-8331Wooguil Pak1https://orcid.org/0000-0002-9551-7373Department of Information and Communication Engineering, Yeungnam University, Gyeongsan-si, South KoreaDepartment of Information and Communication Engineering, Yeungnam University, Gyeongsan-si, South KoreaEarly detection of network intrusions is a very important factor in network security. However, most studies of network intrusion detection systems utilize features for full sessions, making it difficult to detect intrusions before a session ends. To solve this problem, the proposed method uses packet data for features to determine if packets are malicious traffic. Such an approach inevitably increases the probability of falsely detecting normal packets as an intrusion or an intrusion as normal traffic for the initial session. As a solution, the proposed method learns the patterns of packets that are unhelpful in order to classify network intrusions and benign sessions. To this end, a new training dataset for Generative Adversarial Network (GAN) is created using misclassified data from an original training dataset by the LSTM-DNN model trained using the original one. The GAN trained with this dataset has ability to determine whether the currently received packet can be accurately classified in the LSTM-DNN. If the GAN determines that the packet cannot be classified correctly, the detection process is canceled and will be tried again when the next packet is received. Meticulously designed classification algorithm based on LSTM-DNN and validation model using GAN enable the proposed algorithm to accurately perform network intrusion detection in real time without session termination or delay time for collecting a certain number of packets. Various experiments confirm that the proposed method can detect intrusions very early (before the end of the session) while maintaining detection performance at a level similar to that of the existing methods.https://ieeexplore.ieee.org/document/9945961/Intrusion detectiongenerative adversarial networkearly detectionreal-time detection |
| spellingShingle | Taehoon Kim Wooguil Pak Early Detection of Network Intrusions Using a GAN-Based One-Class Classifier IEEE Access Intrusion detection generative adversarial network early detection real-time detection |
| title | Early Detection of Network Intrusions Using a GAN-Based One-Class Classifier |
| title_full | Early Detection of Network Intrusions Using a GAN-Based One-Class Classifier |
| title_fullStr | Early Detection of Network Intrusions Using a GAN-Based One-Class Classifier |
| title_full_unstemmed | Early Detection of Network Intrusions Using a GAN-Based One-Class Classifier |
| title_short | Early Detection of Network Intrusions Using a GAN-Based One-Class Classifier |
| title_sort | early detection of network intrusions using a gan based one class classifier |
| topic | Intrusion detection generative adversarial network early detection real-time detection |
| url | https://ieeexplore.ieee.org/document/9945961/ |
| work_keys_str_mv | AT taehoonkim earlydetectionofnetworkintrusionsusingaganbasedoneclassclassifier AT wooguilpak earlydetectionofnetworkintrusionsusingaganbasedoneclassclassifier |