Intrusion Detection using Deep Neural Networks Milad Ghaznavi

Outline Introduction Dataset Multi Layer Perceptron Convolutional Neural Network Evaluation Related Work Conclusion

Introduction Intrusion Detection Background

DDoS attack an example of intrusion Intrusion Detection Definition Example Intrusion = Malicious activity + Policy violation DDoS attack an example of intrusion

Background Misuse Detection Anomaly Detection Training based on labeled data Rich literature using different approaches Data-mining Classification Rare class predictive models Association rules … No labeled data Building the normal behavior of the network Detection of the deviation from the normal behavior

Background - Continue Advantage Disadvantage Misuse Detection Accurate Detection Less false positive Cannot Detect unknown attacks Anomaly Detection Detection of the unknown attacks High false positive Limited by training data

Dataset Overview OF ISCX Dataset Features OF ISCX Dataset

Overview OF ISCX Dataset 7 Days Traffic from July 11, 2010 to July 17, 2010 Normal Bruteforce + Infiltrating HTTP DDoS DDoS Bruteforce SSH

Features OF ISCX Dataset Type appName Alphabetic destination IP Address sourcePayloadAsUTF Unicode sensorInterfaceId Numeric sourcePort Port number sourcePayloadAsBase64 protocolName destinationPort destinationPayloadAsBase64 direction totalSourceBytes destinationPayloadAsUTF sourceTCPFlagsDescription totalDestinationBytes startDateTime Datetime destinationTCPFlagsDescription totalSourcePackets stopDateTime source totalDestinationPackets Tag Label Payload Tag Features Payload Tag

Multi Layer Perceptron Dataset Preprocessing Training and Testing Network Designs Results

Dataset Preprocessing Payload is discarded Among 17 features 12 features are selected Are digitized Are normalized Features Payload Tag Normalized Features Tag Digitize Normalize

Network Design Hyper Parameters design Optimizer: Adam Cost function: Soft-max cross entropy Learning rate: 0.001 Input layer 12 Neurons 2 Hidden layers: Changing number of neurons: 4, 6, 8 Activation function: ReLU Output layer Changing number of neurons: 2, 3, 4, 5, 6

Training and Testing Training Testing Percentage Epochs: Batch size 50%, 60%, 70%, 80%, 90% Epochs: 10, 20, 30, 40, …, 100 Batch size 1000 Percentage 50%, 40%, 30%, 20%, 10%

Results Results for the classification of traffic flows into anomaly and normal A B C

Results - Continue Epoch = 80

Convolutional Neural Network Dataset Preprocessing Results Design

Dataset Preprocessing Convert a well-defined value to a byte-vector Convert a payload to byte-vector Features Payload Tag … Tag Byte-vector The the payload has different size for each flow The payload size can be very long ?

Dataset Preprocessing - Continue Frequency average Frequency standard deviation

Dataset Preprocessing - Continue Frequency average Frequency standard deviation

Dataset Preprocessing - Continue Create the bag of words Words that are in attack flows and not in normal flows Words whose normalized frequencies are in the range of [avg, avg+std] Compare their normalized frequency in the normal flows Samples in bag of words ERR, ModifiedLast, AdminSection, Login, arpa, HacmeBank_v2_Website, dll, login, OvCgi, anonymousPASS, ManagerWORKGROUP, Apache, Unix, … Words whose normalized frequencies lie this range

Dataset Preprocessing - Continue Features Payload Tag … Tag Byte-vector Bag of words

Design 15x15 6 1 4 5

Results Number of Classes = 6 A B

Evaluation Baselines Compared Results

Baselines SVM Nearest Neighbor Classifier Decision Tree

Compared Results Training Percentage of the Dataset = 70

Related Work Summary of Related Work Comparison of Results

Summary of Related Work

Comparison of Results

Conclusion Summary

Summary Network Anomaly Detection Deep learning seems promising in this area