论文标题
鹈鹕：用于网络入侵检测的深层残留网络
Pelican: A Deep Residual Network for Network Intrusion Detection
论文作者
论文摘要
建立安全的网络通信环境的一个挑战是如何有效地检测和防止恶意网络行为。异常的网络活动威胁着用户的隐私，并可能损害了整个网络的功能和基础架构。为了解决此问题，已经使用了网络入侵检测系统（NIDS）。通过不断监视网络活动，系统可以及时识别攻击并提示反击动作。 NIDS多年来一直在发展。当前的NIDS将机器学习（ML）作为核心技术，以提高新型攻击的检测性能。但是，传统的基于ML的检测方法达到的高检测率通常伴随着大型假警报，这极大地影响了其整体性能。在本文中，我们提出了一个深神经网络鹈鹕，该网络建立在特殊设计的残留块上。我们在两个网络流量数据集（NSL-KDD和UNSW-NB15）上评估了鹈鹕。我们的实验表明，与一组最新的基于机器学习的设计相比，鹈鹕可以达到高攻击检测性能，同时保持较低的错误警报率。
One challenge for building a secure network communication environment is how to effectively detect and prevent malicious network behaviours. The abnormal network activities threaten users' privacy and potentially damage the function and infrastructure of the whole network. To address this problem, the network intrusion detection system (NIDS) has been used. By continuously monitoring network activities, the system can timely identify attacks and prompt counter-attack actions. NIDS has been evolving over years. The current-generation NIDS incorporates machine learning (ML) as the core technology in order to improve the detection performance on novel attacks. However, the high detection rate achieved by a traditional ML-based detection method is often accompanied by large false-alarms, which greatly affects its overall performance. In this paper, we propose a deep neural network, Pelican, that is built upon specially-designed residual blocks. We evaluated Pelican on two network traffic datasets, NSL-KDD and UNSW-NB15. Our experiments show that Pelican can achieve a high attack detection performance while keeping a much low false alarm rate when compared with a set of up-to-date machine learning based designs.
