Intrusion Detection Based on Convolutional Neural Network in Complex . . .
237
Table 4. Results of the five-category test experiment
Type
Normal DoS
Probing U2R R2L
Training set 97,278 391,458 4107
1126 52
Test set
60,593 223,298 2377
5993 39
Accuracy(%) 93.9
98.7
82.4
61.5 23.1
56913 817
219
2631
13
1244
2205
72
1393
89
0
0
243
1959
175
0
213
39
86
3684
54
0
0
0
30
9
Actual Value
Predictive Value
Normal DoS Probing R2L U2R
Normal
DoS
Probing
R2L
U2R
56913 817
219
2631
13
1244
2205
72
1393
89
0
0
243
1959
175
0
213
39
86
3684
54
0
0
0
30
9
Actual Value
Predictive Value
Normal DoS Probing R2L U2R
Normal
DoS
Probing
R2L
U2R
Fig. 6. Confusion matrix of test results in the five-category test experiment
4 Conclusion
In this paper, the intrusion detection data set is converted to grayscale through
a series of processing, after which the data is trained and tested by CNN. The
implementation of the whole model, based on TensorFlow, can achieve considerable detection accuracy rapidly and satisfy the real-time detection requirements
of online systems.
However, the accuracy of the proposed method in the five-classification experiment of KDDCUP’99 data set still needs to be improved, especially for the
classification results of different attack types.
In addition, the intrusion detection data set used in this paper is still preprocessed manually. In the future work, we will try to extract the corresponding
features from the original network traffic, so that the proposed method can have
better applicability.
Acknowledgements. This work was supported in part by the National Key R&D
Program of China under Grant 2018YFC0807101, in part by the National Natural Science Foundation of China under Grant 61701503/61571082, and in part by the Ministry
of Science and Technology of China (MOST) Program of International S&T Cooperation under Grant 2016YFE0123200. The work of S. Hu was supported in part by
National Natural Science Foundation of China through the Research Fund for International Young Scientists under Grant 61750110527.
237
Table 4. Results of the five-category test experiment
Type
Normal DoS
Probing U2R R2L
Training set 97,278 391,458 4107
1126 52
Test set
60,593 223,298 2377
5993 39
Accuracy(%) 93.9
98.7
82.4
61.5 23.1
56913 817
219
2631
13
1244
2205
72
1393
89
0
0
243
1959
175
0
213
39
86
3684
54
0
0
0
30
9
Actual Value
Predictive Value
Normal DoS Probing R2L U2R
Normal
DoS
Probing
R2L
U2R
56913 817
219
2631
13
1244
2205
72
1393
89
0
0
243
1959
175
0
213
39
86
3684
54
0
0
0
30
9
Actual Value
Predictive Value
Normal DoS Probing R2L U2R
Normal
DoS
Probing
R2L
U2R
Fig. 6. Confusion matrix of test results in the five-category test experiment
4 Conclusion
In this paper, the intrusion detection data set is converted to grayscale through
a series of processing, after which the data is trained and tested by CNN. The
implementation of the whole model, based on TensorFlow, can achieve considerable detection accuracy rapidly and satisfy the real-time detection requirements
of online systems.
However, the accuracy of the proposed method in the five-classification experiment of KDDCUP’99 data set still needs to be improved, especially for the
classification results of different attack types.
In addition, the intrusion detection data set used in this paper is still preprocessed manually. In the future work, we will try to extract the corresponding
features from the original network traffic, so that the proposed method can have
better applicability.
Acknowledgements. This work was supported in part by the National Key R&D
Program of China under Grant 2018YFC0807101, in part by the National Natural Science Foundation of China under Grant 61701503/61571082, and in part by the Ministry
of Science and Technology of China (MOST) Program of International S&T Cooperation under Grant 2016YFE0123200. The work of S. Hu was supported in part by
National Natural Science Foundation of China through the Research Fund for International Young Scientists under Grant 61750110527.