DTT: A Dual-domain Transformer model for Network Intrusion Detection
DOI:
https://doi.org/10.4108/eetsis.5445Keywords:
Network Intrusion Detection, Dual-domain Feature Extraction, Temporal Convolutional Networks, Input EncodingAbstract
With the rapid evolution of network technologies, network attacks have become increasingly intricate and threatening. The escalating frequency of network intrusions has exerted a profound influence on both industrial settings and everyday activities. This underscores the urgent necessity for robust methods to detect malicious network traffic. While intrusion detection techniques employing Temporal Convolutional Networks (TCN) and Transformer architectures have exhibited commendable classification efficacy, most are confined to the temporal domain. These methods frequently fall short of encompassing the entirety of the frequency spectrum inherent in network data, thereby resulting in information loss. To mitigate this constraint, we present DTT, a novel dual-domain intrusion detection model that amalgamates TCN and Transformer architectures. DTT adeptly captures both high-frequency and low-frequency information, thereby facilitating the simultaneous extraction of local and global features. Specifically, we introduce a dual-domain feature extraction (DFE) block within the model. This block effectively extracts global frequency information and local temporal features through distinct branches, ensuring a comprehensive representation of the data. Moreover, we introduce an input encoding mechanism to transform the input into a format suitable for model training. Experiments conducted on two distinct datasets address concerns regarding data duplication and diverse attack types, respectively. Comparative experiments with recent intrusion detection models unequivocally demonstrate the superior performance of the proposed DTT model.
References
PATIL, D.R. and PATTEWAR, T.M. (2022) Majority voting and feature selection based network intrusion detection system. EAI Endorsed Transactions on Scalable Information Systems 9(6): e6. doi: 10.4108/eai.4-4-2022.173780, https://¬publications.eai.eu/¬index.php/¬sis/¬article/¬view/¬350.
NOVAES NETO, N., MADNICK, S., DE PAULA, M.G., MALARA BORGES, N. et al. (2021) A case study of the capital one data breach: Why didn’t compliance requirements help prevent it? Journal of Information System Security 17(1): 49–78. http://¬dx.doi.org/¬10.2139/¬ssrn.3542567.
PEISERT, S., SCHNEIER, B., OKHRAVI, H., MASSACCI, F., BENZEL, T., LANDWEHR, C., MANNAN, M. et al. (2021) Perspectives on the solarwinds incident. IEEE Security & Privacy 19(2): 7–13. doi: 10.1109/MSEC.2021.3051235.
YIN, J., TANG, M., CAO, J., YOU, M., WANG, H. and ALAZAB, M. (2023) Knowledge-driven cybersecurity intelligence: Software vulnerability coexploitation behavior discovery. IEEE Transactions on Industrial Informatics 19(4): 5593–5601. doi: 10.1109/TII.2022.3192027.
ZHANG, C., COSTA-PEREZ, X. and PATRAS, P. (2022) Adversarial attacks against deep learning-based network intrusion detection systems and defense mechanisms. IEEE/ACM Transactions on Networking 30(3): 1294–1311. doi: 10.1109/TNET.2021.3137084.
BLAISE, A., BOUET, M., CONAN, V. and SECCI, S. (2020) Detection of zero-day attacks: An unsupervised port-based approach. Computer Networks 180: 107391. doi: https://doi.org/10.1016/j.comnet.2020.107391, https://¬www.sciencedirect.com/¬science/¬article/¬pii/¬S1389128620300761.
LIU, F., ZHOU, X., CAO, J., WANG, Z., WANG, T., WANG, H. and ZHANG, Y. (2022) Anomaly detection in quasi-periodic time series based on automatic data segmentation and attentional lstm-cnn. IEEE Transactions on Knowledge and Data Engineering 34(6): 2626–2640. doi: 10.1109/TKDE.2020.3014806.
VASWANI, A., SHAZEER, N., PARMAR, N., USZKOREIT, J., JONES, L., GOMEZ, A.N., KAISER, L.U. et al. (2017) Attention is all you need. In GUYON, I., LUXBURG, U.V., BENGIO, S., WALLACH, H., FERGUS, R., VISHWANATHAN, S. and GARNETT, R. [eds.] Advances in Neural Information Processing Systems (Curran Associates, Inc.), 30. https://¬proceedings.neurips.cc/¬paper_files/¬paper/¬2017/¬file/¬3f5ee243547dee91fbd053c1c4a845aa-Paper.pdf.
ABDEL-BASSET, M., HAWASH, H., CHAKRABORTTY, R.K. and RYAN, M.J. (2021) Semi-supervised spatiotemporal deep learning for intrusions detection in iot networks. IEEE Internet of Things Journal 8(15): 12251–12265. doi: 10.1109/JIOT.2021.3060878.
LIANG, P., YANG, L., XIONG, Z., ZHANG, X. and LIU, G. (2024) Multi-level intrusion detection based on transformer and wavelet transform for iot data security. IEEE Internet of Things Journal : 1–1doi: 10.1109/JIOT.2024.3369034.
CHENG, P., XU, K., LI, S. and HAN, M. (2022) Tcan-ids: Intrusion detection system for internet of vehicle using temporal convolutional attention network. Symmetry 14(2). doi: 10.3390/sym14020310, https://¬www.mdpi.com/¬2073-8994/¬14/¬2/¬310.
SHAO, M., QIAO, Y., MENG, D. and ZUO, W. (2023) Uncertainty-guided hierarchical frequency domain transformer for image restoration. Knowledge-Based Systems 263: 110306. doi: https://doi.org/10.1016/j.knosys.2023.110306, https://¬www.sciencedirect.com/¬science/¬article/¬pii/¬S0950705123000564.
ALVI, A.M., SIULY, S. and WANG, H. (2023) A long short-term memory based framework for early detection of mild cognitive impairment from eeg signals. IEEE Transactions on Emerging Topics in Computational Intelligence 7(2): 375–388. doi: 10.1109/TETCI.2022.3186180.
FU, C., LI, Q., SHEN, M. and XU, K. (2023) Frequency domain feature based robust malicious traffic detection. IEEE/ACM Transactions on Networking 31(1): 452–467. doi: 10.1109/TNET.2022.3195871.
ZHONG, Z., SUN, L., SUBRAMANI, S., PENG, D. and WANG, Y. (2023) Time series classification for portable medical devices. EAI Endorsed Transactions on Scalable Information Systems 10(4): e19. doi: 10.4108/eetsis.v10i3.3219, https://¬publications.eai.eu/¬index.php/¬sis/¬article/¬view/¬3219.
SINGH, R., SUBRAMANI, S., DU, J., ZHANG, Y., WANG, H., MIAO, Y. and AHMED, K. (2023) Antisocial behavior identification from twitter feeds using traditional machine learning algorithms and deep learning. EAI Endorsed Transactions on Scalable Information Systems 10(4): e17. doi: 10.4108/eetsis.v10i3.3184, https://¬publications.eai.eu/¬index.php/¬sis/¬article/¬view/¬3184.
LI, Y., YUAN, X. and LI, W. (2022) An extreme semi-supervised framework based on transformer for network intrusion detection. In Proceedings of the 31st ACM International Conference on Information & Knowledge Management, CIKM ’22 (New York, NY, USA: Association for Computing Machinery): 4204–4208. doi: 10.1145/3511808.3557549, https://¬doi.org/¬10.1145/¬3511808.3557549.
MANOCCHIO, L.D., LAYEGHY, S., LO, W.W., KULATILLEKE, G.K., SARHAN, M. and PORTMANN, M. (2024) Flowtransformer: A transformer framework for flow-based network intrusion detection systems. Expert Systems with Applications 241: 122564. doi: https://doi.org/10.1016/j.eswa.2023.122564, https://¬www.sciencedirect.com/¬science/¬article/¬pii/-S095741742303066X.
HAN, X., CUI, S., LIU, S., ZHANG, C., JIANG, B. and LU, Z. (2023) Network intrusion detection based on n-gram frequency and time-aware transformer. Computers & Security 128: 103171. doi: https://doi.org/10.1016/j.cose.2023.103171, https://¬www.sciencedirect.com/¬science/¬article/¬pii/¬S0167404823000810.
NGUYEN, L.G. and WATABE, K. (2022) Flow-based network intrusion detection based on bert masked language model. In Proceedings of the 3rd International CoNEXT Student Workshop, CoNEXT-SW ’22 (New York, NY, USA: Association for Computing Machinery): 7–8. doi: 10.1145/3565477.3569152, https://¬doi.org/¬10.1145/¬3565477.3569152.
WU, Z., ZHANG, H., WANG, P. and SUN, Z. (2022) Rtids: A robust transformer-based approach for intrusion detection system. IEEE Access 10: 64375–64387. doi: 10.1109/ACCESS.2022.3182333.
NAM, M., PARK, S. and KIM, D.S. (2021) Intrusion detection method using bi-directional gpt for in-vehicle controller area networks. IEEE Access 9: 124931–124944. doi: 10.1109/ACCESS.2021.3110524.
SADIQUE, F. and SENGUPTA, S. (2022) Modeling and analyzing attacker behavior in iot botnet using temporal convolution network (tcn). Computers & Security 117: 102714. doi: https://doi.org/10.1016/j.cose.2022.102714, https://¬www.sciencedirect.com/¬science/¬article/¬pii/¬S0167404822001092.
CAI, S., XU, H., LIU, M., CHEN, Z. and ZHANG, G. (2024) A malicious network traffic detection model based on bidirectional temporal convolutional network with multi-head self-attention mechanism. Computers & Security 136: 103580. doi: https://doi.org/10.1016/j.cose.2023.103580, https://¬www.sciencedirect.com/¬science/¬article/¬pii/¬S016740482300490X.
JIAO, X., LI, J. and WEN, M. (2022) Intrusion detection based on feature selection and temporal convolutional network in mobile edge computing environment. International Journal of Network Security 24(2): 286–295. doi: 10.6633/IJNS.202203_24(2).11.
YANG, R., HE, H., XU, Y., XIN, B., WANG, Y., QU, Y. and ZHANG, W. (2023) Efficient intrusion detection toward iot networks using cloud-edge collaboration. Computer Networks 228: 109724. doi: https://doi.org/10.1016/j.comnet.2023.109724, https://¬www.sciencedirect.com/¬science/¬article/¬pii/¬S138912862300169X.
HASSAN, M.M., GUMAEI, A., ALSANAD, A., ALRUBAIAN, M. and FORTINO, G. (2020) A hybrid deep learning model for efficient intrusion detection in big data environment. Information Sciences 513: 386–396. doi: https://doi.org/10.1016/j.ins.2019.10.069, https://¬www.sciencedirect.com/¬science/¬article/¬pii/¬S0020025519310382.
SHEYKHKANLOO, N.M. and HALL, A. (2020) Insider threat detection using supervised machine learning algorithms on an extremely imbalanced dataset. Int. J. Cyber Warf. Terror. 10(2): 1–26. doi: 10.4018/IJCWT.2020040101, https://¬doi.org/¬10.4018/¬IJCWT.2020040101.
XIAO, X., XIAO, W., LI, R., LUO, X., ZHENG, H. and XIA, S. (2022) Ebsnn: Extended byte segment neural network for network traffic classification. IEEE Transactions on Dependable and Secure Computing 19(5): 3521–3538. doi: 10.1109/TDSC.2021.3101311.
G., M. (2022) Design of intrusion detection and prevention model using coot optimization and hybrid lstm-knn classifier for manet. EAI Endorsed Transactions on Scalable Information Systems 10(3): e2. doi: 10.4108/eetsis.v10i3.2574, https://¬publications.eai.eu/¬index.php/¬sis/¬article/¬view/¬2574.
VENKATESWARAN, N. and PRABAHARAN, S.P. (2022) An efficient neuro deep learning intrusion detection system for mobile adhoc networks. EAI Endorsed Transactions on Scalable Information Systems 9(6): e7. doi: 10.4108/eai.4-4-2022.173781, https://¬publications.eai.eu/¬index.php/¬sis/¬article/¬view/¬351.
ZIPPERLE, M., GOTTWALT, F., CHANG, E. and DILLON, T. (2022) Provenance-based intrusion detection systems: A survey. ACM Comput. Surv. 55(7). doi: 10.1145/3539605, https://¬doi.org/¬10.1145/¬3539605.
YANG, Z., LIU, X., LI, T., WU, D., WANG, J., ZHAO, Y. and HAN, H. (2022) A systematic literature review of methods and datasets for anomaly-based network intrusion detection. Computers & Security 116: 102675. doi: https://doi.org/10.1016/j.cose.2022.102675, https://¬www.sciencedirect.com/¬science/¬article/¬pii/¬S0167404822000736.
MIKOLOV, T., SUTSKEVER, I., CHEN, K., CORRADO, G. and DEAN, J. (2013) Distributed representations of words and phrases and their compositionality. In Proceedings of the 26th International Conference on Neural Information Processing Systems - Volume 2, NIPS’13 (Red Hook, NY, USA: Curran Associates Inc.): 3111–3119.
SARHAN, M., LAYEGHY, S. and PORTMANN, M. (2022) Towards a standard feature set for network intrusion detection system datasets. Mobile Networks & Applications 27(1): 357 – 370. https://¬search.ebscohost.com/¬login.aspx?direct=true&db=asn&AN=155954870&lang=zh-cn&site=eds-live.
SHARAFALDIN, I., LASHKARI, A.H. and GHORBANI, A.A. (2018) Toward generating a new intrusion detection dataset and intrusion traffic characterization. In MORI, P., FURNELL, S. and CAMP, O. [eds.] Proceedings of the 4th International Conference on Information Systems Security and Privacy, ICISSP 2018, Funchal, Madeira - Portugal, January 22-24, 2018 (SciTePress): 108–116. doi: 10.5220/0006639801080116, https://¬doi.org/¬10.5220/¬0006639801080116.
MOUSTAFA, N. and SLAY, J. (2015) Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In 2015 Military Communications and Information Systems Conference (MilCIS): 1–6. doi: 10.1109/MilCIS.2015.7348942.
GAO, J. and BHARDWAJ, A. (2022) Network intrusion detection method combining cnn and bilstm in cloud computing environment. Intell. Neuroscience 2022. doi: 10.1155/2022/7272479, https://¬doi.org/¬10.1155/¬2022/¬7272479.
SUN, L., LI, C., LIU, B. and ZHANG, Y. (2023) Class-driven graph attention network for multi-label time series classification in mobile health digital twins. IEEE Journal on Selected Areas in Communications 41(10): 3267–3278. doi: 10.1109/JSAC.2023.3310064.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2023 Chenjian Xu, Weirui Sun, Mengxue Li
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
This is an open access article distributed under the terms of the CC BY-NC-SA 4.0, which permits copying, redistributing, remixing, transformation, and building upon the material in any medium so long as the original work is properly cited.
