Study of long short-term memory in flow-based network intrusion detection system

Abstract

The adoption of network flow in the domain of Network-based Intrusion Detection System (NIDS) has steadily risen in popularity. Typically, NIDS detects network intrusions by inspecting the contents of every packet. Flow-based approach, however, uses only features derived from aggregated packet headers. In this paper, all publicly accessible and labeled NIDS data sets are explored. Following the advances in deep learning techniques, the performances of Long Short-Term Memory (LSTM) are also presented and compared with various machine learning classifiers. Amongst the reviewed data sets, the models are trained and evaluated on CIDDS-001 flow-based data set.