Network Intrusion Detection System with Time-Based Sequential Cluster Models using LSTM and GRU

Abstract

Technological development and the growth of the internet today have a positive and revolutionary impact in various areas of human life, such as banking, health, science, and more. The presence of Open Data and Open API also facilitates the exchange of data and information between entities without the restrictions imposed by different regions and geographical areas. However, information openness not only has a positive impact but also makes data vulnerable to data theft, viruses, and various other types of cyber attacks. The large-scale data exchange that occurs across the network poses a challenge in detecting unusual activity and new cyber attacks. Therefore, the existence of an Intrusion Detection System (IDS) is urgently essential. The IDS helps system administrators detect cyber attacks and network anomalies, thus minimizing the risk of data leaks and intrusions. The research developed a new approach using time-based sequential clustered data sets in the Long Short Term Memory (LSTM) and Gated Recurrent Unit (GRU) models. This IDS model was implemented using the CIC-IDS 2018 data set, which has more than 4 million data lines. The capabilities and uniqueness of the LSTM and GRU models are used to classify and determine various attacks in IDS based on sequential data sets ordered by time and clustered according to the destination ports and protocols, such as TCP and UDP. The model was evaluated using the accuracy, precision, recall, and F-1 scores matrix, and the results showed that the time-based sequential clustered models in LSTM and GRU have an accurities of up to 97.21%. This suggests that this new approach is good enough to be applied to the future IDS models.