SCGNet-Stacked Convolution with Gated Recurrent Unit Network for Cyber Network Intrusion Detection and Intrusion Type Classification

TL;DR

This paper introduces SCGNet, a deep learning architecture combining stacked convolution and GRU, achieving high accuracy in network intrusion detection and attack classification on the NSL-KDD dataset.

Contribution

The study proposes a novel SCGNet architecture and a general data preprocessing pipeline, demonstrating improved performance over traditional methods in intrusion detection.

Findings

Achieved 99.76% accuracy in attack detection

Achieved 98.92% accuracy in attack classification

Validated the data pipeline with conventional machine learning methods

Abstract

Intrusion detection system (IDS) is a piece of hardware or software that looks for malicious activity or policy violations in a network. It looks for malicious activity or security flaws on a network or system. IDS protects hosts or networks by looking for indications of known attacks or deviations from normal behavior (Network-based intrusion detection system, or NIDS for short). Due to the rapidly increasing amount of network data, traditional intrusion detection systems (IDSs) are far from being able to quickly and efficiently identify complex and varied network attacks, especially those linked to low-frequency attacks. The SCGNet (Stacked Convolution with Gated Recurrent Unit Network) is a novel deep learning architecture that we propose in this study. It exhibits promising results on the NSL-KDD dataset in both task, network attack detection, and attack type classification with 99.76% and 98.92% accuracy, respectively. We have also introduced a general data preprocessing pipeline that is easily applicable to other similar datasets. We have also experimented with conventional machine-learning techniques to evaluate the performance of the data processing pipeline.