traffic classification

network traffic

encrypted traffic

attack detection

network intrusion

Applied Soft Computing

‘Curse of dimensionality’ and the trade-off between low false alarm rate and high detection rate are the major concerns while designing an efficient intrusion detection system. In this study, we propose a hybrid framework comprising deep auto-encoder (AE) with the long short term memory (LSTM) and the bidirectional long short term memory (Bi-LSTM) for intrusion detection system by obtaining optimal features using AE and then LSTMs for classification into normal and anomaly samples. The performance of the proposed models is evaluated on the well-known dataset NSL-KDD in terms of error indices including precision, recall, F-score, accuracy, detection rate (DR), and false alarm rate (FAR). Experimental results indicate that the proposed AE-LSTM performance is significantly better with less prediction error as compared to other deep and shallow machine learning techniques including other recently reported methods. On the NSL-KDD dataset, AE-LSTM shows classification accuracy of 89% with DR of 89.84% and FAR of 11% which demonstrates the enhanced performance of the proposed model over recent state-of-the-art techniques. • An anomaly detection model is proposed through optimal feature selection using AE. • Robust feature space for classification with high detection rate and low false alarm rate. • AE-LSTM on the NSL-KDD dataset is reported for high training efficiency and less computation cost. • Comparison with baseline classifiers and existing methods reveals the strength of AE-LSTM. • Statistical analysis of the proposed model ensures its stability and efficiency.

A two-stage intrusion detection system with auto-encoder and LSTMs