1. Intrusion Detection using Deep Neural Networks
Milad Ghaznavi

2. Outline Introduction Dataset Multi Layer Perceptron
Convolutional Neural Network
Evaluation
Related Work
Conclusion

3. Introduction
Intrusion Detection
Background

4. DDoS attack an example of intrusion
Intrusion Detection
Definition
Example
Intrusion = Malicious activity + Policy violation
DDoS attack an example of intrusion

5. Background Misuse Detection Anomaly Detection
Training based on labeled data
Rich literature using different approaches
Data-mining
Classification
Rare class predictive models
Association rules …
No labeled data
Building the normal behavior of the network
Detection of the deviation from the normal behavior

6. Background - Continue Advantage Disadvantage Misuse Detection
Accurate Detection
Less false positive
Cannot Detect unknown attacks
Anomaly Detection
Detection of the unknown attacks
High false positive
Limited by training data

7. Dataset
Overview OF ISCX Dataset
Features OF ISCX Dataset

8. Overview OF ISCX Dataset
7 Days Traffic from July 11, 2010 to July 17, 2010
Normal
Bruteforce +
Infiltrating
HTTP DDoS
DDoS
Bruteforce SSH

9. Features OF ISCX Dataset
Type
appName
Alphabetic
destination
IP Address
sourcePayloadAsUTF
Unicode
sensorInterfaceId
Numeric
sourcePort
Port number
sourcePayloadAsBase64
protocolName
destinationPort
destinationPayloadAsBase64
direction
totalSourceBytes
destinationPayloadAsUTF
sourceTCPFlagsDescription
totalDestinationBytes
startDateTime
Datetime
destinationTCPFlagsDescription
totalSourcePackets
stopDateTime
source
totalDestinationPackets
Tag
Label
Payload
Tag
Features
Payload
Tag

10. Multi Layer Perceptron
Dataset Preprocessing
Training and Testing
Network Designs
Results

11. Dataset Preprocessing
Payload is discarded
Among 17 features
12 features are selected
Are digitized
Are normalized
Features
Payload
Tag
Normalized Features
Tag
Digitize
Normalize

12. Network Design Hyper Parameters design Optimizer: Adam
Cost function: Soft-max cross entropy
Learning rate: 0.001
Input layer
12 Neurons
2 Hidden layers:
Changing number of neurons: 4, 6, 8
Activation function: ReLU
Output layer
Changing number of neurons: 2, 3, 4, 5, 6

13. Training and Testing Training Testing Percentage Epochs: Batch size
50%, 60%, 70%, 80%, 90%
Epochs:
10, 20, 30, 40, …, 100
Batch size
1000
Percentage
50%, 40%, 30%, 20%, 10%

14. Results
Results for the classification of traffic flows into anomaly and normal A B C

15. Results - Continue
Epoch = 80

16. Convolutional Neural Network
Dataset Preprocessing
Results
Design

17. Dataset Preprocessing
Convert a well-defined value to a byte-vector
Convert a payload to byte-vector
Features
Payload
Tag …
Tag
Byte-vector
The the payload has different size for each flow
The payload size can be very long ?

18. Dataset Preprocessing - Continue
Frequency average
Frequency standard deviation

19. Dataset Preprocessing - Continue
Frequency average
Frequency standard deviation

20. Dataset Preprocessing - Continue
Create the bag of words
Words that are in attack flows and not in normal flows
Words whose normalized frequencies are in the range of [avg, avg+std]
Compare their normalized frequency in the normal flows
Samples in bag of words
ERR, ModifiedLast, AdminSection, Login, arpa, HacmeBank_v2_Website, dll, login, OvCgi, anonymousPASS, ManagerWORKGROUP, Apache, Unix, …
Words whose normalized frequencies lie this range

21. Dataset Preprocessing - Continue
Features
Payload
Tag …
Tag
Byte-vector
Bag of words

22. Design
15x15 6 1 4 5

23. Results
Number of Classes = 6 A B

24. Evaluation
Baselines
Compared Results

25. Baselines
SVM
Nearest Neighbor Classifier
Decision Tree

26. Compared Results
Training Percentage of the Dataset = 70

27. Related Work
Summary of Related Work
Comparison of Results

28. Summary of Related Work

29. Comparison of Results

30. Conclusion
Summary

31. Summary Network Anomaly Detection
Deep learning seems promising in this area