Real-time intrusion detection based on residual learning through ResNet algorithm

Abstract

Over the years, attacks from the Internet have grown more advanced and can bypass simple security measures like antivirus scanners and firewalls. With the rapid development of systems administration applications and software-based frameworks, the need to develop better security strategies for defending against digital attacks has become acute. Identifying, detecting, and preventing intrusions are critical for network security in today's connected world of computation. A potential way to enhance network protection is to include an alternative layer to defend the network framework through intrusion detection system (IDS). This paper defines a model for IDS based on a deep learning strategy. The model employs ResNet50, which is 50 layers deep, a convolutional neural network. ResNet offers advancement over the conventional machine learning methods that do not suffice to reduce the false alarm rate. The proposed IDS model aims to detect intrusions by categorizing all network packets into normal or malicious groups. During the experimental work, the proposed model is trained and validated using three datasets: the network security laboratory knowledge discovery in databases, the CICIDS2017 dataset from the Canadian Institute for Cyber Security Intrusion Detection System, and the UNSW Canberra, Australia (UNSW2015) dataset from the University of New South Wales (UNSW). The model's overall accuracy, recall, precision and F1 score have been measured and substantiated with the ROC curve. Later the performance of the model is further confirmed by comparing it with seven other well-known machine learning classifiers that include Naïve Bayes, support vector machine, AdaBoost, k-nearest neighbour, random forest, decision tree and linear regression. Accuracy rate as high as 97.65% emphasizes that the proposed model has great potential in outperforming the existing methods.