Research On The Network Intrusion Detection Based On RNN And Attention Mechanism

The rapid development of Internet technology has greatly changed people's lives and promoted social progress.In addition,under the strategy of the "Internet Plus",Internet-related equipment and technologies have gradually been integrated into different fields.However,the use of new technologies to conduct intrusion attacks has become increasingly complex and diversified,resulting in network security issues more and more serious.Intrusion Detection System is a powerful tool for network security protection,and can actively detect potential intrusions in the network.Unfortunately,traditional intrusion detection systems cannot effectively deal with the current complex network environment.Problems that are gradually exposed including the low detection accuracy,high latency,and poor adaptability.An intrusion detection model with excellent performance is an urgent need.This paper intends to build an intrusion detection model based on deep recurrent neural network and attention mechanism.The main contents are as follows:(1)An SSAE-RNN intrusion detection model is presented.In order to solve the problem of high dimension of data,the Stacked Sparse Autoencoder(SSAE)was applied for data preprocessing.After that,different recurrent neuron variants were adopted for further feature extraction.And the influence of different timesteps was studied.Experiments are conducted on the UNSW-NB15 dataset and the detection accuracy of our SSAE-RNN model can reach 98.17%,which is 2.46% improvement over traditional Bi LSTM network.Besides,the proposed model is better than than mainstream detection models such as gradient boosted trees and deep feedforward neural networks,which proved the effectiveness and cutting-edge of the proposed model.(2)With the help of former experiments,the Bi GRU could be a proper baseline model for further research.The attention mechanism is introduced to the former model and an intrusion detection model named HABG was built based on hierarchical attention mechanism.Two different kinds of attention mechanism are adopted,where the feature-based attention can help make sense of contribution of different features and the slice-based attention can help to make good use of different data at different timesteps.As a result,HABG model can reach 98.76% of detection accuracy rate on the UNSW-NB15 dataset with an improvement of 3.05% over the traditional Bi LSTM model.Besides,the HABG outperforms than the mainstream methods such as autoencoder,GBT,and OCSVM.(3)Visualization of attention probability is finished.With the help of feature-based and slice-based attention mechanism,the attention probabilities are plot on a map,which shows the different contribution of features and the different importance of each timestep.Visualization analysis can help to better understand the characteristic of features and make good use of data.All in all,the work in this paper is of great meaning for the current intrusion detection problem.Based on deep recurrent neural network and attention mechanism,the proposed approaches can strengthen the ability to detect anomaly traffic data.