ADFCNN-BiLSTM: A Deep Neural Network Based on Attention and Deformable Convolution for Network Intrusion Detection

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• Network intrusion detection systems (NIDS) are crucial for identifying malicious activities by analyzing network traffic.
• Detecting rare intrusion events within massive datasets and classifying attack types remain significant challenges.
• Existing NIDS often struggle to fully leverage spatial and temporal features in network traffic data.

Purpose of the Study:

• To propose ADFCNN-BiLSTM, a novel deep neural network designed for enhanced network intrusion detection.
• To improve the extraction of spatial and temporal features from network traffic data for more accurate intrusion identification.
• To address the class imbalance problem inherent in intrusion detection datasets.

Main Methods:

• ADFCNN-BiLSTM integrates deformable convolution and an attention mechanism for adaptive spatial feature extraction, considering both channel and spatial aspects.
• BiLSTM is employed to effectively mine temporal features from network traffic.
• A multi-head attention mechanism is utilized to focus on time-series information pertinent to suspicious traffic, and class imbalance is managed at both data and algorithmic levels.

Main Results:

• The proposed ADFCNN-BiLSTM model was evaluated on the NSL-KDD, UNSW-NB15, and CICDDoS2019 datasets.
• Experimental results demonstrate superior performance compared to state-of-the-art models.
• Key performance metrics including accuracy, detection rate, and false-positive rate were significantly improved.

Conclusions:

• ADFCNN-BiLSTM offers a robust and effective deep learning approach for network intrusion detection.
• The model's ability to extract complex spatial and temporal features enhances its capability in identifying diverse network attacks.
• The proposed methods for handling class imbalance contribute to more reliable and accurate intrusion detection systems.