End-to-End Network Intrusion Detection Based on Contrastive Learning
Abstract
:1. Introduction
- We design a hierarchical model that combines CNN and GRU networks for the autonomous extraction of spatiotemporal features from raw traffic data. Furthermore, an embedding layer is integrated to enhance the representation dimension of the protocol header bytes, which contain more important information.
- We propose an intrusion detection framework based on contrastive learning. Contrastive loss can offer a wider decision boundary margin compared to cross-entropy loss. Using cosine similarity with benign traffic representations as the basis of detection can lead to higher accuracy and a lower false alarm rate. Moreover, unknown attacks can be detected.
- We introduce the granularity of IP pairs for packet collection. Compared with flow-level, IP pair granularity can present inter-flow characteristics, which has advantages for discovering attack traffic that looks normal in a single flow, such as Dos and PortScan.
- The proposed framework undergoes evaluation using widely utilized datasets, namely, CIC-IDS2017 [19] and CSE-CIC-IDS2018 [20]. The results demonstrate that our approach can attain a detection accuracy of 99.9% for known attacks, thus achieving state-of-the-art performance. For unknown attacks, a weighted recall rate of 95% can be achieved.
2. Related Work
3. Methodology
- How can we automate the extraction of general effective features from raw traffic data without the need for complex feature engineering?Extracting useful features from raw traffic is challenging because network behavior typically involves numerous packets, some of which may be encrypted. Considering the intra- and inter-features of packets, we design a hierarchical structure. We utilize CNN to learn the spatial features of a single packet and GRU networks to learn the temporal features of sequential packets.
- How can a network intrusion detection model be trained to ensure a significant margin between the decision boundary and the training points?It has been shown that cross-entropy loss results in a much smaller margin between the decision boundary and the training points than optimal. As a result, the trained IDS is sensitive to noisy labels, susceptible to adversarial sample attacks, and challenging to detect unknown attack traffic. In this paper, we employ contrastive loss to represent benign traffic more compactly in the embedding space and separate attack traffic from benign traffic, thereby widening the margin of the decision boundary of the trained model. As a result, the trained model becomes more robust in the presence of noisy labels and adversarial samples, enabling the detection of unknown attacks.
3.1. Framework
- Data processing. Upon the arrival of network traffic packets, it is necessary to transform them into a compatible format that can be readily utilized by deep learning models. The packets are grouped either at the flow level or IP pair level and then organized in a sequential order according to their respective arrival times. Subsequently, the raw bytes of the packets are extracted for use as input.
- Feature extraction. Taking into account the spatial features of an individual packet and the temporal relationships between packets, we design a hierarchical model based on CNN and GRU for automated feature extraction. In the case of protocol header bytes, an embedding layer is incorporated to enhance the dimension of data representation, rather than solely relying on numerical values.
- Training. Contrastive loss is used to promote the formation of a compact cluster for the representation vectors of benign traffic, while simultaneously ensuring a significant separation from the representation vectors of malicious traffic. As a result, the distinction between benign and malicious traffic is magnified in the representation space, leading to increased robustness.
- Detection. The core of the benign clusters is determined by calculating the average of the representations of benign flows in the training set. The anomaly score is determined by calculating the cosine similarity between the test representation and the core vector. Consequently, unknown attacks can be identified based on their low similarity to benign traffic.
3.2. Data Processing
3.2.1. Capture Packets
3.2.2. Segment Packets According to a Fixed Window Size
3.2.3. Extract Packet Data
3.3. Feature Extraction
3.3.1. Inputs
3.3.2. Normalization
3.3.3. Model Structures
3.3.4. Packet Spatial Feature Extraction
3.3.5. Temporal Feature Extraction
3.4. Training and Detecting
3.4.1. Contrastive Loss
3.4.2. Detecting
4. Experiments
4.1. Dataset and Experimental Setup
4.2. Detection Results on Different Datasets
4.3. Detection Results with Different Hyperparameters
4.3.1. Detection Results with Different Window Size W
4.3.2. Detection Results with Different
4.4. Ablation Study
4.4.1. Embedding Layer
4.4.2. The Hierarchical CNN and GRU Model
5. Conclusions
Author Contributions
Funding
Institutional Review Board Statement
Informed Consent Statement
Data Availability Statement
Conflicts of Interest
Abbreviations
CNN | Convolutional Neural Network |
GRU | Gated Recurrent Unit |
IoT | Internet of Things |
NIDS | Network intrusion detection system |
RNN | Recurrent Neural Network |
PCA | Principal Component Analysis |
TCP | Transmission Control Protocol |
IP | Internet Protocol |
References
- Davis, J.J.; Clark, A.J. Data Preprocessing for Anomaly Based Network Intrusion Detection: A Review. Comput. Secur. 2011, 30, 353–375. [Google Scholar] [CrossRef]
- Sommer, R.; Paxson, V. Outside the Closed World: On Using Machine Learning for Network Intrusion Detection. In Proceedings of the 2010 IEEE Symposium on Security and Privacy, Oakland, CA, USA, 16–19 May 2010; pp. 305–316. [Google Scholar] [CrossRef]
- García-Teodoro, P.; Díaz-Verdejo, J.; Maciá-Fernández, G.; Vázquez, E. Anomaly-Based Network Intrusion Detection: Techniques, Systems and Challenges. Comput. Secur. 2009, 28, 18–28. [Google Scholar] [CrossRef]
- Eskandari, M.; Janjua, Z.H.; Vecchio, M.; Antonelli, F. Passban IDS: An Intelligent Anomaly-Based Intrusion Detection System for IoT Edge Devices. IEEE Internet Things J. 2020, 7, 6882–6897. [Google Scholar] [CrossRef]
- Yang, Z.; Liu, X.; Li, T.; Wu, D.; Wang, J.; Zhao, Y.; Han, H. A Systematic Literature Review of Methods and Datasets for Anomaly-Based Network Intrusion Detection. Comput. Secur. 2022, 116, 102675. [Google Scholar] [CrossRef]
- Dharmapurikar, S.; Lockwood, J. Fast and Scalable Pattern Matching for Network Intrusion Detection Systems. IEEE J. Sel. Areas Commun. 2006, 24, 1781–1792. [Google Scholar] [CrossRef]
- Mahdavifar, S.; Ghorbani, A.A. DeNNeS: Deep Embedded Neural Network Expert System for Detecting Cyber Attacks. Neural Comput. Appl. 2020, 32, 14753–14780. [Google Scholar] [CrossRef]
- Liu, J.; Yin, L.; Hu, Y.; Lv, S.; Sun, L. A Novel Intrusion Detection Algorithm for Industrial Control Systems Based on CNN and Process State Transition. In Proceedings of the 2018 IEEE 37th International Performance Computing and Communications Conference (IPCCC), Orlando, FL, USA, 17–19 November 2018; pp. 1–8. [Google Scholar] [CrossRef]
- Teng, S.; Wu, N.; Zhu, H.; Teng, L.; Zhang, W. SVM-DT-Based Adaptive and Collaborative Intrusion Detection. IEEE/CAA J. Autom. Sin. 2018, 5, 108–118. [Google Scholar] [CrossRef]
- Abbes, T.; Bouhoula, A.; Rusinowitch, M. Efficient Decision Tree for Protocol Analysis in Intrusion Detection. Int. J. Secur. Netw. 2010, 5, 220–235. [Google Scholar] [CrossRef]
- Mehmood, A.; Mukherjee, M.; Ahmed, S.H.; Song, H.; Malik, K.M. NBC-MAIDS: Naïve Bayesian Classification Technique in Multi-Agent System-Enriched IDS for Securing IoT against DDoS Attacks. J. Supercomput. 2018, 74, 5156–5170. [Google Scholar] [CrossRef]
- Li, X.; Chen, W.; Zhang, Q.; Wu, L. Building Auto-Encoder Intrusion Detection System Based on Random Forest Feature Selection. Comput. Secur. 2020, 95, 101851. [Google Scholar] [CrossRef]
- Zhong, Y.; Chen, W.; Wang, Z.; Chen, Y.; Wang, K.; Li, Y.; Yin, X.; Shi, X.; Yang, J.; Li, K. HELAD: A Novel Network Anomaly Detection Model Based on Heterogeneous Ensemble Learning. Comput. Netw. 2020, 169, 107049. [Google Scholar] [CrossRef]
- Alzubi, J.A.; Alzubi, O.A.; Qiqieh, I.; Singh, A. A Blended Deep Learning Intrusion Detection Framework For Consumable Edge-Centric IoMT Industry. IEEE Trans. Consum. Electron. 2024. [Google Scholar] [CrossRef]
- Wang, W.; Sheng, Y.; Wang, J.; Zeng, X.; Ye, X.; Huang, Y.; Zhu, M. HAST-IDS: Learning Hierarchical Spatial-Temporal Features Using Deep Neural Networks to Improve Intrusion Detection. IEEE Access 2018, 6, 1792–1806. [Google Scholar] [CrossRef]
- Yu, L.; Dong, J.; Chen, L.; Li, M.; Xu, B.; Li, Z.; Qiao, L.; Liu, L.; Zhao, B.; Zhang, C. PBCNN: Packet Bytes-Based Convolutional Neural Network for Network Intrusion Detection. Comput. Netw. 2021, 194, 108117. [Google Scholar] [CrossRef]
- Zhang, C.; Costa-Perez, X.; Patras, P. Adversarial Attacks Against Deep Learning-Based Network Intrusion Detection Systems and Defense Mechanisms. IEEE/ACM Trans. Netw. 2022, 30, 1294–1311. [Google Scholar] [CrossRef]
- He, K.; Kim, D.D.; Asghar, M.R. Adversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive Survey. IEEE Commun. Surv. Tutor. 2023, 25, 538–566. [Google Scholar] [CrossRef]
- Sharafaldin, I.; Habibi Lashkari, A.; Ghorbani, A.A. Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. In Proceedings of the 4th International Conference on Information Systems Security and Privacy, Funchal, Madeira, Portugal, 22–24 January 2018; pp. 108–116. [Google Scholar] [CrossRef]
- A Realistic Cyber Defense Dataset (CSE-CIC-IDS2018)–Registry of Open Data on AWS. Available online: https://registry.opendata.aws/cse-cic-ids2018/ (accessed on 21 March 2024).
- Mirsky, Y.; Doitshman, T.; Elovici, Y.; Shabtai, A. Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection. In Proceedings of the 2018 Network and Distributed System Security Symposium, San Diego, CA, USA, 18–21 February 2018. [Google Scholar] [CrossRef]
- Xu, C.; Shen, J.; Du, X.; Zhang, F. An Intrusion Detection System Using a Deep Neural Network With Gated Recurrent Units. IEEE Access 2018, 6, 48697–48707. [Google Scholar] [CrossRef]
- Wang, Z.; Thing, V.L. Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms. Comput. Secur. 2023, 128, 103143. [Google Scholar] [CrossRef]
- Wang, W.; Zhu, M.; Wang, J.; Zeng, X.; Yang, Z. End-to-End Encrypted Traffic Classification with One-Dimensional Convolution Neural Networks. In Proceedings of the 2017 IEEE International Conference on Intelligence and Security Informatics (ISI), Beijing, China, 22–24 July 2017; pp. 43–48. [Google Scholar] [CrossRef]
- Lin, K.; Xu, X.; Gao, H. TSCRNN: A Novel Classification Scheme of Encrypted Traffic Based on Flow Spatiotemporal Features for Efficient Management of IIoT. Comput. Netw. 2021, 190, 107974. [Google Scholar] [CrossRef]
- Shapira, T.; Shavitt, Y. FlowPic: Encrypted Internet Traffic Classification Is as Easy as Image Recognition. In Proceedings of the IEEE INFOCOM 2019–IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), Paris, France, 29 April–2 May 2019; pp. 680–687. [Google Scholar] [CrossRef]
- Chen, T.; Kornblith, S.; Norouzi, M.; Hinton, G. A Simple Framework for Contrastive Learning of Visual Representations. arXiv 2020, arXiv:2002.05709. [Google Scholar]
- He, K.; Fan, H.; Wu, Y.; Xie, S.; Girshick, R. Momentum Contrast for Unsupervised Visual Representation Learning. In Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, USA, 13–19 June 2020; pp. 9726–9735. [Google Scholar] [CrossRef]
- Gao, T.; Yao, X.; Chen, D. SimCSE: Simple Contrastive Learning of Sentence Embeddings. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, Online and Punta Cana, Dominican Republic, 7–11 November 2021; pp. 6894–6910. [Google Scholar] [CrossRef]
- Khosla, P.; Teterwak, P.; Wang, C.; Sarna, A.; Tian, Y.; Isola, P.; Maschinot, A.; Liu, C.; Krishnan, D. Supervised Contrastive Learning. arXiv 2021, arXiv:2004.11362. [Google Scholar]
- Wang, N.; Chen, Y.; Hu, Y.; Lou, W.; Hou, Y.T. FeCo: Boosting Intrusion Detection Capability in IoT Networks via Contrastive Learning. In Proceedings of the IEEE INFOCOM 2022–IEEE Conference on Computer Communications, London, UK, 2–5 May 2022; pp. 1409–1418. [Google Scholar] [CrossRef]
- Lopez-Martin, M.; Sanchez-Esguevillas, A.; Arribas, J.I.; Carro, B. Supervised Contrastive Learning over Prototype-Label Embeddings for Network Intrusion Detection. Inf. Fusion 2022, 79, 200–228. [Google Scholar] [CrossRef]
- Yue, Y.; Chen, X.; Han, Z.; Zeng, X.; Zhu, Y. Contrastive Learning Enhanced Intrusion Detection. IEEE Trans. Netw. Serv. Manag. 2022, 19, 4232–4247. [Google Scholar] [CrossRef]
- Shapira, T.; Shavitt, Y. FlowPic: A Generic Representation for Encrypted Traffic Classification and Applications Identification. IEEE Trans. Netw. Serv. Manag. 2021, 18, 1218–1232. [Google Scholar] [CrossRef]
- Dainotti, A.; Pescape, A.; Claffy, K. Issues and Future Directions in Traffic Classification. IEEE Netw. 2012, 26, 35–40. [Google Scholar] [CrossRef]
- He, M.; Wang, X.; Zhou, J.; Xi, Y.; Jin, L.; Wang, X. Deep-Feature-Based Autoencoder Network for Few-Shot Malicious Traffic Detection. Secur. Commun. Netw. 2021, 2021, 6659022. [Google Scholar] [CrossRef]
- Hochreiter, S.; Schmidhuber, J. Long Short-Term Memory. Neural Comput. 1997, 9, 1735–1780. [Google Scholar] [CrossRef] [PubMed]
- Cho, K.; van Merrienboer, B.; Gulcehre, C.; Bahdanau, D.; Bougares, F.; Schwenk, H.; Bengio, Y. Learning Phrase Representations Using RNN Encoder-Decoder for Statistical Machine Translation. arXiv 2014, arXiv:1406.1078. [Google Scholar]
- Degirmenci, A.; Karal, O. Efficient Density and Cluster Based Incremental Outlier Detection in Data Streams. Inf. Sci. 2022, 607, 901–920. [Google Scholar] [CrossRef]
- Paszke, A.; Gross, S.; Massa, F.; Lerer, A.; Bradbury, J.; Chanan, G.; Killeen, T.; Lin, Z.; Gimelshein, N.; Antiga, L.; et al. PyTorch: An Imperative Style, High-Performance Deep Learning Library. In Proceedings of the Advances in Neural Information Processing Systems 32 (NeurIPS 2019), Vancouver, BC, Canada, 8–14 December 2019; Volume 32, pp. 8026–8037. [Google Scholar]
- Liu, L.; Engelen, G.; Lynar, T.; Essam, D.; Joosen, W. Error Prevalence in NIDS Datasets: A Case Study on CIC-IDS-2017 and CSE-CIC-IDS-2018. In Proceedings of the 2022 IEEE Conference on Communications and Network Security (CNS), Austin, TX, USA, 3–5 October 2022; pp. 254–262. [Google Scholar] [CrossRef]
- Wang, F.; Liu, H. Understanding the Behaviour of Contrastive Loss. In Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Nashville, TN, USA, 20–25 June 2021; pp. 2495–2504. [Google Scholar] [CrossRef]
Methods | End-to-End | Unknown Attack Detection | ||
---|---|---|---|---|
Signature-based | Preconfigured Rules or Signatures [6,7] | No | No | |
Anomaly-based | Traditional machine learning | SVM [9], DT [10], KNN [11] | No | No |
Deep Learning | HELAD [13,23] | No | No | |
[12], Kitsune [21,31,32] | No | Yes | ||
HAST-IDS [15], PBCNN [16], FlowPic [24,33,34] | Yes | No | ||
The proposed CHCG | Yes | Yes |
Traffic Category | Total | Train | Test | |
---|---|---|---|---|
Known | Benign | 1,073,124 | 536,562 | 536,562 |
DDoS LOIC | 128,060 | 64,030 | 64,030 | |
DoS Hulk | 124,695 | 62,348 | 62,348 | |
PortScan | 32,406 | 16,203 | 16,203 | |
BruteForce-SSH | 14,025 | 7013 | 7013 | |
BruteForce-FTP | 11,159 | 5580 | 5580 | |
DoS GoldenEye | 10,561 | 5281 | 5281 | |
Unknown | Infiltration | 7445 | 0 | 7445 |
DoS Slowloris | 4757 | 0 | 4757 | |
DoS Slowhttptest | 3966 | 0 | 3966 | |
WebAttack-BruteForce | 3026 | 0 | 3026 | |
Botnet | 1304 | 0 | 1304 | |
WebAttack-XSS | 963 | 0 | 963 | |
WebAttack-SQL Injection | 31 | 0 | 31 | |
All | 1,415,522 | 697,015 | 718,507 |
Traffic Category | w = 10 | w = 20 | w = 30 | |||||||
---|---|---|---|---|---|---|---|---|---|---|
Train | Test | Total | Train | Test | Total | Train | Test | Total | ||
Known | Benign | 205,769,000 | 1,000,000 | 1,000,000 | 92,834,300 | 1,000,000 | 1,000,000 | 68,091,800 | 1,000,000 | 1,000,000 |
DDoS-LOIC-UDP | 9,852,201 | 100,000 | 100,000 | 4,926,098 | 100,000 | 100,000 | 3,284,063 | 100,000 | 100,000 | |
DoS-Hulk | 4,069,009 | 100,000 | 100,000 | 2,034,504 | 100,000 | 100,000 | 1,356,335 | 100,000 | 100,000 | |
SSH-BruteForce | 862,013 | 100,000 | 100,000 | 431,006 | 100,000 | 100,000 | 287,337 | 100,000 | 100,000 | |
Botnet | 734,252 | 100,000 | 100,000 | 367,126 | 100,000 | 100,000 | 244,746 | 100,000 | 100,000 | |
DDoS LOIC-HTTP | 664,234 | 100,000 | 100,000 | 332,118 | 100,000 | 100,000 | 221,402 | 100,000 | 100,000 | |
DDOS-HOIC | 241,474 | 100,000 | 100,000 | 120,736 | 60,368 | 60,368 | 80,485 | 40,243 | 40,242 | |
Infiltration | 79,443 | 39,722 | 39,721 | 39,756 | 19,878 | 19,878 | 26,363 | 13,182 | 13,181 | |
Unknown | DoS-GoldenEye | 51,828 | 0 | 51,828 | 25,917 | 0 | 25,917 | 17,272 | 0 | 17,272 |
DoS-SlowHTTPTest | 42,219 | 0 | 42,219 | 21,109 | 0 | 21,109 | 14,073 | 0 | 14,073 | |
DoS-Slowloris | 21,386 | 0 | 21,386 | 10,693 | 0 | 10,693 | 7128 | 0 | 7128 | |
Brute Force-XSS | 13,648 | 0 | 13,648 | 6823 | 0 | 6823 | 4549 | 0 | 4549 | |
Brute Force-Web | 12,433 | 0 | 12,433 | 6216 | 0 | 6216 | 4143 | 0 | 4143 | |
SQL Injection | 65 | 0 | 65 | 33 | 0 | 33 | 19 | 0 | 19 | |
All | 222,413,205 | 1,639,722 | 1,781,300 | 101,156,435 | 1,580,246 | 1,651,037 | 73,639,715 | 1,553,424 | 1,600,607 |
Category | 2-Layer CNN | 4-Layer CNN | ResNet18 | |||||||
---|---|---|---|---|---|---|---|---|---|---|
RC | AC | F1 | RC | AC | F1 | RC | AC | F1 | ||
Known | DDoS LOIC | 1.0000 | 0.9991 | 0.9958 | 1.0000 | 0.9988 | 0.9945 | 1.0000 | 0.9985 | 0.9932 |
DoS Hulk | 1.0000 | 0.9991 | 0.9957 | 1.0000 | 0.9988 | 0.9944 | 1.0000 | 0.9985 | 0.9930 | |
PortScan | 1.0000 | 0.9990 | 0.9836 | 1.0000 | 0.9987 | 0.9786 | 1.0000 | 0.9984 | 0.9737 | |
BruteForce-SSH | 0.9999 | 0.9990 | 0.9629 | 1.0000 | 0.9987 | 0.9520 | 1.0000 | 0.9983 | 0.9413 | |
BruteForce-FTP | 1.0000 | 0.9990 | 0.9538 | 1.0000 | 0.9987 | 0.9404 | 1.0000 | 0.9983 | 0.9273 | |
DoS GoldenEye | 1.0000 | 0.9990 | 0.9514 | 1.0000 | 0.9987 | 0.9373 | 1.0000 | 0.9983 | 0.9235 | |
Unknown | Infiltration | 0.0930 | 0.9862 | 0.1596 | 0.2836 | 0.9885 | 0.4115 | 0.8867 | 0.9967 | 0.8848 |
DoS Slowloris | 1.0000 | 0.9990 | 0.9463 | 1.0000 | 0.9986 | 0.9308 | 1.0000 | 0.9983 | 0.9158 | |
DoS Slowhttptest | 1.0000 | 0.9990 | 0.9362 | 1.0000 | 0.9986 | 0.9181 | 1.0000 | 0.9983 | 0.9006 | |
WebAttack-BruteForce | 1.0000 | 0.9990 | 0.9181 | 1.0000 | 0.9986 | 0.8954 | 1.0000 | 0.9983 | 0.8736 | |
Botnet | 0.2864 | 0.9976 | 0.3119 | 0.8675 | 0.9984 | 0.6703 | 0.9185 | 0.9982 | 0.6536 | |
WebAttack-XSS | 1.0000 | 0.9990 | 0.7808 | 1.0000 | 0.9986 | 0.7313 | 1.0000 | 0.9983 | 0.6874 | |
WebAttack-SQL Injection | 1.0000 | 0.9990 | 0.0391 | 1.0000 | 0.9986 | 0.0302 | 1.0000 | 0.9983 | 0.0245 | |
Macro-average | 0.8753 | 0.9979 | 0.7642 | 0.9347 | 0.9979 | 0.7988 | 0.9850 | 0.9982 | 0.8225 | |
Weighted-average | 0.9590 | 0.9985 | 0.9478 | 0.9699 | 0.9983 | 0.9560 | 0.9949 | 0.9984 | 0.9714 | |
Unknown-average | 0.6477 | 0.9944 | 0.6261 | 0.7418 | 0.9951 | 0.7190 | 0.9563 | 0.9978 | 0.8730 |
Category | 2-Layer CNN | 4-Layer CNN | ResNet18 | |||||||
---|---|---|---|---|---|---|---|---|---|---|
RC | AC | F1 | RC | AC | F1 | RC | AC | F1 | ||
Known | DDoS-LOIC-UDP | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9953 |
DoS-Hulk | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9953 | |
SSH-BruteForce | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9953 | |
Botnet | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9953 | |
DDoS LOIC-HTTP | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9953 | |
DDOS-HOIC | 1.0000 | 0.9989 | 0.9919 | 1.0000 | 0.9989 | 0.9919 | 1.0000 | 0.9990 | 0.9922 | |
Infiltration | 1.0000 | 0.9989 | 0.9758 | 1.0000 | 0.9989 | 0.9756 | 1.0000 | 0.9989 | 0.9767 | |
Unknown | DoS-GoldenEye | 1.0000 | 0.9989 | 0.9814 | 1.0000 | 0.9989 | 0.9812 | 1.0000 | 0.9989 | 0.9821 |
DoS-SlowHTTPTest | 1.0000 | 0.9989 | 0.9773 | 1.0000 | 0.9989 | 0.9770 | 1.0000 | 0.9989 | 0.9781 | |
DoS-Slowloris | 1.0000 | 0.9989 | 0.9561 | 1.0000 | 0.9989 | 0.9557 | 1.0000 | 0.9989 | 0.9577 | |
Brute Force-XSS | 1.0000 | 0.9989 | 0.9329 | 1.0000 | 0.9989 | 0.9322 | 1.0000 | 0.9989 | 0.9352 | |
Brute Force-Web | 1.0000 | 0.9989 | 0.9268 | 1.0000 | 0.9989 | 0.9261 | 1.0000 | 0.9989 | 0.9294 | |
SQL Injection | 1.0000 | 0.9989 | 0.0594 | 1.0000 | 0.9989 | 0.0588 | 1.0000 | 0.9989 | 0.0616 | |
Macro-average | 1.0000 | 0.9989 | 0.9059 | 1.0000 | 0.9989 | 0.9057 | 1.0000 | 0.9990 | 0.9069 | |
Weighted-average | 1.0000 | 0.9990 | 0.9911 | 1.0000 | 0.9990 | 0.9910 | 1.0000 | 0.9990 | 0.9914 | |
Unknown-average | 1.0000 | 0.9989 | 0.9665 | 1.0000 | 0.9989 | 0.9661 | 1.0000 | 0.9989 | 0.9677 |
Traffic Category | w = 10 | w = 20 | w = 30 | |||||||
---|---|---|---|---|---|---|---|---|---|---|
RC | AC | F1 | RC | AC | F1 | RC | AC | F1 | ||
Known | DDoS-LOIC-UDP | 1.0000 | 0.9990 | 0.9947 | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9956 |
DoS-Hulk | 1.0000 | 0.9990 | 0.9947 | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9956 | |
SSH-BruteForce | 1.0000 | 0.9990 | 0.9947 | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9956 | |
Botnet | 1.0000 | 0.9990 | 0.9947 | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9956 | |
DDoS LOIC-HTTP | 1.0000 | 0.9990 | 0.9947 | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9990 | 0.9956 | |
DDOS-HOIC | 1.0000 | 0.9990 | 0.9947 | 1.0000 | 0.9989 | 0.9919 | 1.0000 | 0.9990 | 0.9891 | |
Infiltration | 0.9999 | 0.9990 | 0.9868 | 1.0000 | 0.9989 | 0.9758 | 1.0000 | 0.9989 | 0.9673 | |
Unknown | DoS-GoldenEye | 1.0000 | 0.9990 | 0.9899 | 1.0000 | 0.9989 | 0.9814 | 1.0000 | 0.9989 | 0.9749 |
DoS-SlowHTTPTest | 1.0000 | 0.9990 | 0.9876 | 1.0000 | 0.9989 | 0.9773 | 1.0000 | 0.9989 | 0.9693 | |
DoS-Slowloris | 1.0000 | 0.9990 | 0.9758 | 1.0000 | 0.9989 | 0.9561 | 1.0000 | 0.9989 | 0.9412 | |
Brute Force-XSS | 1.0000 | 0.9990 | 0.9627 | 1.0000 | 0.9989 | 0.9329 | 0.9560 | 0.9987 | 0.8885 | |
Brute Force-Web | 1.0000 | 0.9990 | 0.9592 | 1.0000 | 0.9989 | 0.9268 | 0.9549 | 0.9987 | 0.8801 | |
SQL Injection | 1.0000 | 0.9989 | 0.1093 | 1.0000 | 0.9989 | 0.0594 | 1.0000 | 0.9989 | 0.0409 | |
Macro-average | 1.0000 | 0.9990 | 0.9184 | 1.0000 | 0.9989 | 0.9059 | 0.9931 | 0.9989 | 0.8945 | |
Weighted-average | 1.0000 | 0.9990 | 0.9919 | 1.0000 | 0.9990 | 0.9911 | 0.9994 | 0.9990 | 0.9910 | |
Unknown-average | 1.0000 | 0.9990 | 0.9814 | 1.0000 | 0.9989 | 0.9665 | 0.9918 | 0.9989 | 0.9511 |
Macro RC | Macro F1 | Weighted F1 | Unknown F1 | |
---|---|---|---|---|
0.03 | 1.0000 | 0.8990 | 0.9886 | 0.9573 |
0.05 | 0.9984 | 0.9034 | 0.9890 | 0.9643 |
0.07 | 1.0000 | 0.9018 | 0.9896 | 0.9611 |
0.1 | 1.0000 | 0.9059 | 0.9911 | 0.9665 |
0.15 | 0.9456 | 0.8714 | 0.9872 | 0.9268 |
0.2 | 1.0000 | 0.9032 | 0.9902 | 0.9630 |
0.5 | 1.0000 | 0.9018 | 0.9897 | 0.9612 |
Category | with Embedding | without Embedding | |||||
---|---|---|---|---|---|---|---|
RC | AC | F1 | RC | AC | F1 | ||
Known | DDoS-LOIC-UDP | 1.0000 | 0.9990 | 0.9951 | 0.9073 | 0.9886 | 0.9424 |
DoS-Hulk | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9981 | 0.9909 | |
SSH-BruteForce | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9981 | 0.9909 | |
Botnet | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9981 | 0.9909 | |
DDoS LOIC-HTTP | 1.0000 | 0.9990 | 0.9951 | 1.0000 | 0.9981 | 0.9909 | |
DDOS-HOIC | 1.0000 | 0.9989 | 0.9919 | 1.0000 | 0.9980 | 0.9851 | |
Infiltration | 1.0000 | 0.9989 | 0.9758 | 0.9999 | 0.9979 | 0.9559 | |
Unknown | DoS-GoldenEye | 1.0000 | 0.9989 | 0.9814 | 0.9999 | 0.9980 | 0.9659 |
DoS-SlowHTTPTest | 1.0000 | 0.9989 | 0.9773 | 1.0000 | 0.9980 | 0.9585 | |
DoS-Slowloris | 1.0000 | 0.9989 | 0.9561 | 1.0000 | 0.9979 | 0.9213 | |
Brute Force-XSS | 1.0000 | 0.9989 | 0.9329 | 0.9052 | 0.9972 | 0.8331 | |
Brute Force-Web | 1.0000 | 0.9989 | 0.9268 | 0.9765 | 0.9977 | 0.8601 | |
SQL Injection | 1.0000 | 0.9989 | 0.0594 | 1.0000 | 0.9979 | 0.0328 | |
Macro-average | 1.0000 | 0.9989 | 0.9059 | 0.9838 | 0.9972 | 0.8784 | |
Weighted-average | 1.0000 | 0.9990 | 0.9911 | 0.9845 | 0.9966 | 0.9757 | |
Unknown-average | 1.0000 | 0.9989 | 0.9665 | 0.9888 | 0.9979 | 0.9344 |
Category | Linear layers + GRU | CNN without GRU | CNN + GRU | ||||
---|---|---|---|---|---|---|---|
RC | F1 | RC | F1 | RC | F1 | ||
Known | DDoS LOIC | 0.9844 | 0.9893 | 1.0000 | 0.9954 | 1.0000 | 0.9951 |
DoS Hulk | 1.0000 | 0.9897 | 1.0000 | 0.9954 | 1.0000 | 0.9951 | |
PortScan | 1.0000 | 0.9897 | 1.0000 | 0.9954 | 1.0000 | 0.9951 | |
BruteForce-SSH | 1.0000 | 0.9897 | 1.0000 | 0.9954 | 1.0000 | 0.9951 | |
BruteForce-FTP | 1.0000 | 0.9897 | 1.0000 | 0.9954 | 1.0000 | 0.9951 | |
DoS GoldenEye | 1.0000 | 0.9831 | 1.0000 | 0.9923 | 1.0000 | 0.9919 | |
Unknown | Infiltration | 1.0000 | 0.9503 | 1.0000 | 0.9770 | 1.0000 | 0.9758 |
DoS Slowloris | 1.0000 | 0.9616 | 1.0000 | 0.9823 | 1.0000 | 0.9814 | |
DoS Slowhttptest | 1.0000 | 0.9532 | 1.0000 | 0.9784 | 1.0000 | 0.9773 | |
WebAttack-BruteForce | 1.0000 | 0.9117 | 1.0000 | 0.9582 | 1.0000 | 0.9561 | |
Botnet | 1.0000 | 0.8682 | 0.8344 | 0.8466 | 1.0000 | 0.9329 | |
WebAttack-XSS | 1.0000 | 0.8571 | 0.8970 | 0.8764 | 1.0000 | 0.9268 | |
WebAttack-SQL Injection | 1.0000 | 0.0291 | 0.9677 | 0.0604 | 1.0000 | 0.0594 | |
Macro-average | 0.9988 | 0.8817 | 0.9769 | 0.8960 | 1.0000 | 0.9059 | |
Weighted-average | 0.9976 | 0.9817 | 0.9973 | 0.9901 | 1.0000 | 0.9911 | |
Unknown-average | 1.0000 | 0.9330 | 0.9750 | 0.9547 | 1.0000 | 0.9665 |
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. |
© 2024 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Li, L.; Lu, Y.; Yang, G.; Yan, X. End-to-End Network Intrusion Detection Based on Contrastive Learning. Sensors 2024, 24, 2122. https://doi.org/10.3390/s24072122
Li L, Lu Y, Yang G, Yan X. End-to-End Network Intrusion Detection Based on Contrastive Learning. Sensors. 2024; 24(7):2122. https://doi.org/10.3390/s24072122
Chicago/Turabian StyleLi, Longlong, Yuliang Lu, Guozheng Yang, and Xuehu Yan. 2024. "End-to-End Network Intrusion Detection Based on Contrastive Learning" Sensors 24, no. 7: 2122. https://doi.org/10.3390/s24072122