Malicious Network Traffic Detection Based on Deep Neural Networks and Association Analysis
Anomaly detection systems can accurately identify malicious network traffic, providing network security. With the development of internet technology, network attacks are becoming more and more sourced and complicated, making it difficult for traditional anomaly detection systems to effectively analy...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2020-03-01
|
| Series: | Sensors |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1424-8220/20/5/1452 |
| _version_ | 1811185241434357760 |
|---|---|
| author | Minghui Gao Li Ma Heng Liu Zhijun Zhang Zhiyan Ning Jian Xu |
| author_facet | Minghui Gao Li Ma Heng Liu Zhijun Zhang Zhiyan Ning Jian Xu |
| author_sort | Minghui Gao |
| collection | DOAJ |
| description | Anomaly detection systems can accurately identify malicious network traffic, providing network security. With the development of internet technology, network attacks are becoming more and more sourced and complicated, making it difficult for traditional anomaly detection systems to effectively analyze and identify abnormal traffic. At present, deep neural network (DNN) technology achieved great results in terms of anomaly detection, and it can achieve automatic detection. However, there still exists misclassified traffic in the prediction results of deep neural networks, resulting in redundant alarm information. This paper designs a two-level anomaly detection system based on deep neural network and association analysis. We made a comprehensive evaluation of experiments using DNNs and other neural networks based on publicly available datasets. Through the experiments, we chose DNN-4 as an important part of our system, which has high precision and accuracy in identifying malicious traffic. The Apriori algorithm can mine rules between various discretized features and normal labels, which can be used to filter the classified traffic and reduce the false positive rate. Finally, we designed an intrusion detection system based on DNN-4 and association rules. We conducted experiments on the public training set NSL-KDD, which is considered as a modified dataset for the KDDCup 1999. The results show that our detection system has great precision in malicious traffic detection, and it achieves the effect of reducing the number of false alarms. |
| first_indexed | 2024-04-11T13:27:13Z |
| format | Article |
| id | doaj.art-d38f9b401e104e50bcf27ab19e9865e5 |
| institution | Directory Open Access Journal |
| issn | 1424-8220 |
| language | English |
| last_indexed | 2024-04-11T13:27:13Z |
| publishDate | 2020-03-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Sensors |
| spelling | doaj.art-d38f9b401e104e50bcf27ab19e9865e52022-12-22T04:22:02ZengMDPI AGSensors1424-82202020-03-01205145210.3390/s20051452s20051452Malicious Network Traffic Detection Based on Deep Neural Networks and Association AnalysisMinghui Gao0Li Ma1Heng Liu2Zhijun Zhang3Zhiyan Ning4Jian Xu5China NARI Group Corporation (State Grid Electronic Power Research Institute), Nanjing 211106, ChinaChina NARI Group Corporation (State Grid Electronic Power Research Institute), Nanjing 211106, ChinaSoftware College, Northeastern University, Shenyang 110169, ChinaChina NARI Group Corporation (State Grid Electronic Power Research Institute), Nanjing 211106, ChinaChina NARI Group Corporation (State Grid Electronic Power Research Institute), Nanjing 211106, ChinaSoftware College, Northeastern University, Shenyang 110169, ChinaAnomaly detection systems can accurately identify malicious network traffic, providing network security. With the development of internet technology, network attacks are becoming more and more sourced and complicated, making it difficult for traditional anomaly detection systems to effectively analyze and identify abnormal traffic. At present, deep neural network (DNN) technology achieved great results in terms of anomaly detection, and it can achieve automatic detection. However, there still exists misclassified traffic in the prediction results of deep neural networks, resulting in redundant alarm information. This paper designs a two-level anomaly detection system based on deep neural network and association analysis. We made a comprehensive evaluation of experiments using DNNs and other neural networks based on publicly available datasets. Through the experiments, we chose DNN-4 as an important part of our system, which has high precision and accuracy in identifying malicious traffic. The Apriori algorithm can mine rules between various discretized features and normal labels, which can be used to filter the classified traffic and reduce the false positive rate. Finally, we designed an intrusion detection system based on DNN-4 and association rules. We conducted experiments on the public training set NSL-KDD, which is considered as a modified dataset for the KDDCup 1999. The results show that our detection system has great precision in malicious traffic detection, and it achieves the effect of reducing the number of false alarms.https://www.mdpi.com/1424-8220/20/5/1452network trafficdeep neural networksapriori association algorithmanomaly detection |
| spellingShingle | Minghui Gao Li Ma Heng Liu Zhijun Zhang Zhiyan Ning Jian Xu Malicious Network Traffic Detection Based on Deep Neural Networks and Association Analysis Sensors network traffic deep neural networks apriori association algorithm anomaly detection |
| title | Malicious Network Traffic Detection Based on Deep Neural Networks and Association Analysis |
| title_full | Malicious Network Traffic Detection Based on Deep Neural Networks and Association Analysis |
| title_fullStr | Malicious Network Traffic Detection Based on Deep Neural Networks and Association Analysis |
| title_full_unstemmed | Malicious Network Traffic Detection Based on Deep Neural Networks and Association Analysis |
| title_short | Malicious Network Traffic Detection Based on Deep Neural Networks and Association Analysis |
| title_sort | malicious network traffic detection based on deep neural networks and association analysis |
| topic | network traffic deep neural networks apriori association algorithm anomaly detection |
| url | https://www.mdpi.com/1424-8220/20/5/1452 |
| work_keys_str_mv | AT minghuigao maliciousnetworktrafficdetectionbasedondeepneuralnetworksandassociationanalysis AT lima maliciousnetworktrafficdetectionbasedondeepneuralnetworksandassociationanalysis AT hengliu maliciousnetworktrafficdetectionbasedondeepneuralnetworksandassociationanalysis AT zhijunzhang maliciousnetworktrafficdetectionbasedondeepneuralnetworksandassociationanalysis AT zhiyanning maliciousnetworktrafficdetectionbasedondeepneuralnetworksandassociationanalysis AT jianxu maliciousnetworktrafficdetectionbasedondeepneuralnetworksandassociationanalysis |