Hybrid intrusion detection and signature generation using Deep Recurrent Neural Networks

被引:59
作者
Kaur, Sanmeet [1 ]
Singh, Maninder [1 ]
机构
[1] Thapar Univ Patiala, Comp Sci & Engn Dept, Patiala, Punjab, India
关键词
Deep learning; Intrusion Detection System; LSTM; Attack detection; Signature generation; Machine learning; Web attacks; Zero-day attack; LEARNING APPROACH;
D O I
10.1007/s00521-019-04187-9
中图分类号
TP18 [人工智能理论];
学科分类号
081104 ; 0812 ; 0835 ; 1405 ;
摘要
Automated signature generation for Intrusion Detection Systems (IDSs) for proactive security of networks is a promising area of research. An IDS monitors a system or activities of a network for detecting any policy violations or malicious actions and produces reports to the management system. Numerous solutions have been proposed by various researchers so far for intrusion detection in networks. However, the need to efficiently identifying any intrusion in the network is on the rise as the network attacks are increasing exponentially. This research work proposes a deep learning-based system for hybrid intrusion detection and signature generation of unknown web attacks referred as D-Sign. D-Sign is capable of successfully detecting and generating attack signatures with high accuracy, sensitivity and specificity. It has been for attack detection and signature generation of web-based attacks. D-Sign has reported significantly low False Positives and False Negatives. The experimental results demonstrated that the proposed system identifies the attacks proactively than other state-of-the-art approaches and generates signatures effectively thereby causing minimum damage due to network attacks.
引用
收藏
页码:7859 / 7877
页数:19
相关论文
共 37 条
[21]   F-Sign: Automatic, Function-Based Signature Generation for Malware [J].
Shabtai, Asaf ;
Menahem, Eitan ;
Elovici, Yuval .
IEEE TRANSACTIONS ON SYSTEMS MAN AND CYBERNETICS PART C-APPLICATIONS AND REVIEWS, 2011, 41 (04) :494-508
[22]   Towards An Attack Signature Generation Framework for Intrusion Detection Systems [J].
Shahriar, Hossain ;
Bond, William .
2017 IEEE 15TH INTL CONF ON DEPENDABLE, AUTONOMIC AND SECURE COMPUTING, 15TH INTL CONF ON PERVASIVE INTELLIGENCE AND COMPUTING, 3RD INTL CONF ON BIG DATA INTELLIGENCE AND COMPUTING AND CYBER SCIENCE AND TECHNOLOGY CONGRESS(DASC/PICOM/DATACOM/CYBERSCI, 2017, :597-603
[23]   Intrusion detection using reduced-size RNN based on feature grouping [J].
Sheikhan, Mansour ;
Jadidi, Zahra ;
Farrokhi, Ali .
NEURAL COMPUTING & APPLICATIONS, 2012, 21 (06) :1185-1190
[24]  
Singh S, 2004, USENIX ASSOCIATION PROCEEDINGS OF THE SIXTH SYMPOSIUM ON OPERATING SYSTEMS DESIGN AND IMPLEMENTATION (OSDE '04), P45
[25]  
Singh S., 2003, The earlybird system for real-time detection of unknown worms
[26]   Auto-Sign: an automatic signature generator for high-speed malware filtering devices [J].
Tahan, Gil ;
Glezer, Chanan ;
Elovici, Yuval ;
Rokach, Lior .
JOURNAL OF COMPUTER VIROLOGY AND HACKING TECHNIQUES, 2010, 6 (02) :91-103
[27]  
Tang TA, 2016, 2016 INTERNATIONAL CONFERENCE ON WIRELESS NETWORKS AND MOBILE COMMUNICATIONS (WINCOM), pP258, DOI 10.1109/WINCOM.2016.7777224
[28]  
Tang Y, 2005, IEEE INFOCOM SER, P1384
[29]   ONLINE CONSTRUCTION OF SUFFIX TREES [J].
UKKONEN, E .
ALGORITHMICA, 1995, 14 (03) :249-260
[30]  
Wang K, 2004, LECT NOTES COMPUT SC, V3224, P203