Deep memory for deep threats: A novel architecture combining GRUs and deep learning models for IDS

Area of Science:

• Cybersecurity and Artificial Intelligence
• Network Intrusion Detection Systems
• Deep Learning Architectures

Background:

• Conventional Intrusion Detection Systems (IDS) struggle with the increasing volume and sophistication of cyber threats, especially in dynamic environments like the Internet of Things (IoT).
• Existing IDS are often obsolete due to their inability to capture temporal trends in evolving threats, leading to limitations in detecting complex, low, slow, and zero-day intrusions.

Purpose of the Study:

• To propose a novel hybrid deep learning architecture, the Neural Turing Machine-Gated Recurrent Unit (NTM-GRU) model, to overcome the limitations of conventional IDS.
• To enhance intrusion detection capabilities by incorporating external memory and temporal learning for analyzing dual timescales and capturing both short- and long-term dependencies.

Main Methods:

• Developed a hybrid deep learning architecture combining the external memory capabilities of Neural Turing Machines (NTMs) with the temporal learning power of Gated Recurrent Units (GRUs).
• Evaluated the NTM-GRU model on standard datasets (UNSW-NB15, BoT-IoT) and real-world datasets (CICIDS2017, CSE-CID-IS2018) for intrusion detection.
• Assessed the model's performance based on accuracy, F1-scores, false positive rates, and real-time inference speed.

Main Results:

• Achieved high effectiveness with an accuracy of 99.98% and F1-scores up to 96% on unknown threats.
• Demonstrated low false positive rates, below 0.4%, indicating high precision in threat identification.
• Real-time inference speed measured at 2.3 milliseconds, suitable for high-speed network environments.
• The model incorporates interpretability features, making it valuable for Security Operation Centres (SOCs).

Conclusions:

• The NTM-GRU model offers a scalable, adaptive, and interpretable solution for intrusion detection, establishing a new state-of-the-art standard.
• The proposed framework effectively addresses the shortcomings of conventional IDS in detecting advanced cyber threats in contemporary network structures, including IoT.
• The hybrid architecture's ability to analyze dual timescales and capture complex dependencies makes it highly effective for securing next-generation networks.