An Autonomous Intrusion Detection System Using an Ensemble of Advanced Learners
This work addresses the need for more intelligent and autonomous security systems in computer networks, particularly for detecting zero-day attacks, but it is incremental as it combines existing learning techniques.
The paper tackles the problem of improving intrusion detection systems (IDS) by making them more autonomous and effective against zero-day attacks, achieving 87.28% accuracy on the NSL-KDD 'KDDTest+' dataset and 76.61% on the challenging 'KDDTest-21' with reduced training time and computational resources.
An intrusion detection system (IDS) is a vital security component of modern computer networks. With the increasing amount of sensitive services that use computer network-based infrastructures, IDSs need to be more intelligent and autonomous. Aside from autonomy, another important feature for an IDS is its ability to detect zero-day attacks. To address these issues, in this paper, we propose an IDS which reduces the amount of manual interaction and needed expert knowledge and is able to yield acceptable performance under zero-day attacks. Our approach is to use three learning techniques in parallel: gated recurrent unit (GRU), convolutional neural network as deep techniques and random forest as an ensemble technique. These systems are trained in parallel and the results are combined under two logics: majority vote and "OR" logic. We use the NSL-KDD dataset to verify the proficiency of our proposed system. Simulation results show that the system has the potential to operate with a very low technician interaction under the zero-day attacks. We achieved 87:28% accuracy on the NSL-KDD's "KDDTest+" dataset and 76:61% accuracy on the challenging "KDDTest-21" with lower training time and lower needed computational resources.