Multi-Class Anomaly-based Intrusion Detection System Using Transformers
Open AccessThe increase in hybrid and remote work has provided new remote access capabilities to corporate users. Unfortunately, this has also made them vulnerable to sophisticated attacks, including attackers’ theft of corporate credentials. Intrusion Detection Systems (IDS) are essential parts of many organizations’ security strategies to quickly detect and report these security threats or violations, allowing swift actions or responses.Traditional machine learning techniques have been successfully deployed in anomaly-based IDSs but have high false positive rates and rely on time-consuming “feature extraction” (Ketepalli & Bulla, 2022) and selection approaches to train models to detect malicious traffic. Transformers models are exceptionally well-positioned to detect known and unknown threats because of their scalability and unique ability to pick up on complex non-linear patterns and correlations directly from the raw dataset.This study presents a Transformer model, which learns directly from raw network traffic and automatically identifies the most predictive features in an IDS dataset. Our approach utilized the "Bidirectional Encoder Representations from Transformers (BERT)” (Devlin et al., 2018) model, which was trained on a vast corpus of encrypted network traffic without labels. We “fine-tuned” (Reyes et al., 2015) this model with 6,400 labeled instances of traffic from the Canadian Institute for Cybersecurity (CIC-IDS2018) IDS 2018. Based on our experiments, the model we proposed has the ability to decrease False Positive Rates and enhance the performance of anomaly-based IDSs.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.