RNNIDS: Enhancing Network Intrusion Detection Systems through Deep Learning

TL;DR

This paper introduces RNNIDS, a deep learning-based approach using Recurrent Neural Networks to generate synthetic attack data and improve network intrusion detection systems, especially against zero-day threats.

Contribution

The paper demonstrates for the first time that RNNs can generate unseen attack mutants and synthetic signatures to enhance NIDS detection capabilities.

Findings

Up to 16.67% improvement in detection rate.

RNNs effectively generate new attack variants.

Enhanced evaluation of NIDS with synthetic malicious datasets.

Abstract

Security of information passing through the Internet is threatened by today's most advanced malware ranging from orchestrated botnets to simpler polymorphic worms. These threats, as examples of zero-day attacks, are able to change their behavior several times in the early phases of their existence to bypass the network intrusion detection systems (NIDS). In fact, even well-designed, and frequently-updated signature-based NIDS cannot detect the zero-day treats due to the lack of an adequate signature database, adaptive to intelligent attacks on the Internet. More importantly, having an NIDS, it should be tested on malicious traffic dataset that not only represents known attacks, but also can to some extent reflect the characteristics of unknown, zero-day attacks. Generating such traffic is identified in the literature as one of the main obstacles for evaluating the effectiveness of NIDS. To address these issues, we introduce RNNIDS that applies Recurrent Neural Networks (RNNs) to find complex patterns in attacks and generate similar ones. In this regard, for the first time, we demonstrate that RNNs are helpful to generate new, unseen mutants of attacks as well as synthetic signatures from the most advanced malware to improve the intrusion detection rate. Besides, to further enhance the design of an NIDS, RNNs can be employed to generate malicious datasets containing, e.g., unseen mutants of a malware. To evaluate the feasibility of our approaches, we conduct extensive experiments by incorporating publicly available datasets, where we show a considerable improvement in the detection rate of an off-the-shelf NIDS (up to 16.67%).