A Temporal Convolutional Network-based Approach for Network Intrusion Detection

TL;DR

This paper introduces a Temporal Convolutional Network-based model for network intrusion detection, leveraging dilated convolutions and residual blocks to improve accuracy and speed in identifying cyberattacks in complex network traffic.

Contribution

The study presents a novel TCN architecture with residual blocks for intrusion detection, outperforming traditional CNN and RNN-based models on a comprehensive dataset.

Findings

Achieved 96.72% accuracy on Edge-IIoTset dataset.

Outperformed existing CNN and RNN models in detection performance.

Demonstrated effectiveness across multiple attack categories.

Abstract

Network intrusion detection is critical for securing modern networks, yet the complexity of network traffic poses significant challenges to traditional methods. This study proposes a Temporal Convolutional Network(TCN) model featuring a residual block architecture with dilated convolutions to capture dependencies in network traffic data while ensuring training stability. The TCN's ability to process sequences in parallel enables faster, more accurate sequence modeling than Recurrent Neural Networks. Evaluated on the Edge-IIoTset dataset, which includes 15 classes with normal traffic and 14 cyberattack types, the proposed model achieved an accuracy of 96.72% and a loss of 0.0688, outperforming 1D CNN, CNN-LSTM, CNN-GRU, CNN-BiLSTM, and CNN-GRU-LSTM models. A class-wise classification report, encompassing metrics such as recall, precision, accuracy, and F1-score, demonstrated the TCN model's superior performance across varied attack categories, including Malware, Injection, and DDoS. These results underscore the model's potential in addressing the complexities of network intrusion detection effectively.