ARLIF-IDS -- Attention augmented Real-Time Isolation Forest Intrusion Detection System

TL;DR

This paper introduces an attention-augmented Isolation Forest model for real-time intrusion detection that significantly reduces training time and resource consumption while maintaining high detection accuracy on benchmark datasets.

Contribution

It proposes a novel attention-based extension to the Isolation Forest algorithm, enhancing efficiency and effectiveness in intrusion detection with fewer features.

Findings

Reduces training time by 91.78%

Achieves an F1-Score of 0.93 on benchmark datasets

Outperforms existing machine learning-based IDS methods

Abstract

Distributed Denial of Service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. Emerging technologies such as the Internet of Things and Software Defined Networking leverage lightweight strategies for the early detection of DDoS attacks. Previous literature demonstrates the utility of lower number of significant features for intrusion detection. Thus, it is essential to have a fast and effective security identification model based on low number of features. In this work, a novel Attention-based Isolation Forest Intrusion Detection System is proposed. The model considerably reduces training time and memory consumption of the generated model. For performance assessment, the model is assessed over two benchmark datasets, the NSL-KDD dataset & the KDDCUP'99 dataset. Experimental results demonstrate that the proposed attention augmented model achieves a significant reduction in execution time, by 91.78%, and an average detection F1-Score of 0.93 on the NSL-KDD and KDDCUP'99 dataset. The results of performance evaluation show that the proposed methodology has low complexity and requires less processing time and computational resources, outperforming other current IDS based on machine learning algorithms.