Multidomain transformer-based deep learning for early detection of network intrusion

TL;DR

This paper introduces a novel deep learning framework using multi-domain transformers for early detection of network intrusions, significantly improving detection speed and accuracy over existing methods.

Contribution

It proposes a new feature extractor, a benchmark dataset, and a multi-domain transformer model with enhanced attention mechanisms for early network intrusion detection.

Findings

Achieved 84.1% macro F1 score, 31% higher than Transformer.

Improved earliness by 5x10^4 times in packet usage.

Outperformed state-of-the-art methods by 5-6% on benchmark datasets.

Abstract

Timely response of Network Intrusion Detection Systems (NIDS) is constrained by the flow generation process which requires accumulation of network packets. This paper introduces Multivariate Time Series (MTS) early detection into NIDS to identify malicious flows prior to their arrival at target systems. With this in mind, we first propose a novel feature extractor, Time Series Network Flow Meter (TS-NFM), that represents network flow as MTS with explainable features, and a new benchmark dataset is created using TS-NFM and the meta-data of CICIDS2017, called SCVIC-TS-2022. Additionally, a new deep learning-based early detection model called Multi-Domain Transformer (MDT) is proposed, which incorporates the frequency domain into Transformer. This work further proposes a Multi-Domain Multi-Head Attention (MD-MHA) mechanism to improve the ability of MDT to extract better features. Based on the experimental results, the proposed methodology improves the earliness of the conventional NIDS (i.e., percentage of packets that are used for classification) by 5x10^4 times and duration-based earliness (i.e., percentage of duration of the classified packets of a flow) by a factor of 60, resulting in a 84.1% macro F1 score (31% higher than Transformer) on SCVIC-TS-2022. Additionally, the proposed MDT outperforms the state-of-the-art early detection methods by 5% and 6% on ECG and Wafer datasets, respectively.