Intrusion Detection Based on Convolutional Neural Network in Complex . . .
231
2.1 Data Preprocessing
KDDCUP’99 data set is a standard data set used for the research on intrusion
detection systems. Each record in KDDCUP’99 data set consists of 41 features
and a label representing the type.
Due to non-numerical features and large differences in the dimensions of
KDDCUP’99 data set, it is difficult to directly apply the CNN algorithm for
intrusion detection classification. Therefore, as shown in Fig. 2, the data set
needs to be preprocessed, and the main data preprocessing includes numerical
processing, dimensionality reduction, and one-hot encoding.
0,tcp,http,SF,181,5450,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,8,8,0.00,0.00,0.00,0.00,1.00,0.00,0.00,9
,9,1.00,0.00,0.11,0.00,0.00,0.00,0.00,0.00,normal
0,2,2,2,181,5450,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,8,8,0.00,0.00,0.00,0.00,1.00,0.00,0.00,9,
9,1.00,0.00,0.11,0.00,0.00,0.00,0.00,0.00,0
0,2,2,2,181,5450,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,8,8,0.00,0.00,0.00,0.00,1.00,0.00,
0.00,9,9,1.00,0.00,0.11,0
.txt
.csv
Tensor
Discretization of character values
Features reduce to 36×1
Reshape data as grayscale(6×6) & label one-hot coding normal=10…0
normal=0
Raw Data
Grayscale
CNN
Fig. 2. Example of data processing for KDDCUP’99 data set
Numerical Processing Features 2 (protocol type), 3 (service), 4 (flag) and
the label of each connection in KDDCUP’99 data set are not numeric types,
which need to be converted to numeric types to unify the format of data. In this
paper, the values of feature 2 are represented by [0, 2]; the values of feature 3
are represented by [0, 69]; the values of feature 4 are represented by [0, 10]; the
values of the label are represented by [0, 22].
Dimensionality Reduction Feature 1 (duration) represents the duration
of the network connection. Feature 7 (land) is 1 when the connection comes
from/delivers to the same host/port, otherwise it is 0. Feature 9 (urgent) indicates the number of expedited packages. Feature 21 (is hot login) is 1 when
the login belongs to the ‘host’ list, otherwise, it is 0. It can be found that
features 1, 7, 9, and 21 are almost 0 in KDDCUP’99 data set. Feature 20
(num outbound cmds), indicating the number of outbound connections in an
231
2.1 Data Preprocessing
KDDCUP’99 data set is a standard data set used for the research on intrusion
detection systems. Each record in KDDCUP’99 data set consists of 41 features
and a label representing the type.
Due to non-numerical features and large differences in the dimensions of
KDDCUP’99 data set, it is difficult to directly apply the CNN algorithm for
intrusion detection classification. Therefore, as shown in Fig. 2, the data set
needs to be preprocessed, and the main data preprocessing includes numerical
processing, dimensionality reduction, and one-hot encoding.
0,tcp,http,SF,181,5450,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,8,8,0.00,0.00,0.00,0.00,1.00,0.00,0.00,9
,9,1.00,0.00,0.11,0.00,0.00,0.00,0.00,0.00,normal
0,2,2,2,181,5450,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,8,8,0.00,0.00,0.00,0.00,1.00,0.00,0.00,9,
9,1.00,0.00,0.11,0.00,0.00,0.00,0.00,0.00,0
0,2,2,2,181,5450,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,8,8,0.00,0.00,0.00,0.00,1.00,0.00,
0.00,9,9,1.00,0.00,0.11,0
.txt
.csv
Tensor
Discretization of character values
Features reduce to 36×1
Reshape data as grayscale(6×6) & label one-hot coding normal=10…0
normal=0
Raw Data
Grayscale
CNN
Fig. 2. Example of data processing for KDDCUP’99 data set
Numerical Processing Features 2 (protocol type), 3 (service), 4 (flag) and
the label of each connection in KDDCUP’99 data set are not numeric types,
which need to be converted to numeric types to unify the format of data. In this
paper, the values of feature 2 are represented by [0, 2]; the values of feature 3
are represented by [0, 69]; the values of feature 4 are represented by [0, 10]; the
values of the label are represented by [0, 22].
Dimensionality Reduction Feature 1 (duration) represents the duration
of the network connection. Feature 7 (land) is 1 when the connection comes
from/delivers to the same host/port, otherwise it is 0. Feature 9 (urgent) indicates the number of expedited packages. Feature 21 (is hot login) is 1 when
the login belongs to the ‘host’ list, otherwise, it is 0. It can be found that
features 1, 7, 9, and 21 are almost 0 in KDDCUP’99 data set. Feature 20
(num outbound cmds), indicating the number of outbound connections in an