Intrusion detection with HACDT-Net and TRBM-Net using a hybrid deep learning framework with enhanced sampling...

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Network Security

Background:

• Cyber threats necessitate robust network protection. Conventional intrusion detection systems (IDS) struggle with class imbalance, leading to missed rare attacks.
• Deep Learning (DL) offers advanced solutions, but hybrid architectures and adaptive sampling are crucial for overcoming limitations.

Purpose of the Study:

• To enhance network intrusion detection by integrating DL models with advanced resampling techniques.
• To address class imbalance and improve feature extraction for more accurate threat identification.

Main Methods:

• Developed two hybrid DL models: HACTD-Net (Autoencoder-CNN + Transformer-DNN) and TRBM-Net (1D-TCN-ResNet-BiGRU-Multi-Head Attention).
• Employed resampling techniques like ADASYN-SMOTE, ENN, and Borderline SMOTE-OSS for class balancing and synthetic data generation.
• Evaluated models on CICIDS2017 and NF-BoT-IoT-v2 datasets, measuring accuracy, precision, recall, and F1-score.

Main Results:

• HACTD-Net achieved 99.88% classification accuracy, showing strong performance against diverse network attacks.
• TRBM-Net, utilizing multi-head self-attention, reached 99.72% accuracy, improving rare attack detection and reducing false alarms.
• Both models demonstrated significant improvements in IDS performance through hybrid DL and resampling.

Conclusions:

• Hybrid deep learning models combined with optimized resampling techniques substantially enhance IDS performance.
• Integrating contextual/spatial feature extraction with balanced data boosts detection rates, especially for infrequent threats.
• Results support the development of real-time, adaptive IDS for contemporary network security challenges.