Training Multi-Layer Deep Neural Networks Using Hybrid Algorithms to Detect Network Intrusions

Abstract

One of the challenges facing security analysts and administrators is to enable intrusion detection in network systems, preventing intruders from entering the network. Network intrusion detection is usually signature-based and plays an effective role in detecting only known attacks. However, there are concerns about unknown attacks and the difficulty arises here. Which requires creating a model that can detect network attacks by discovering anomalies in the network. Therefore, in this article, an approach to detecting attacks is presented by monitoring the behavior of data and training it to distinguish between network traffic, which is normal traffic, and traffic that is classified as an attack on the network. The known database was used NSL-KDD, a dataset that monitors network traffic including various types of network attacks and detects normal traffic, it also contains numerous patterns and features. It includes 41 features for each traffic and is divided into five classifications. The four types are classified as types of network attacks and the fifth as normal traffic. One of the difficulties and problems is the existence of a wide variety of features. This requires finding a way to extract features that can have a significant impact on the results to achieve greater accuracy in classifying the type of attack. For this reason, principal component analysis PCA technology has been used to reduce feature sizes. Six models were created which are hybrid algorithms to optimize the performance of a multi-layer neural network by training their weights to classify the attack type in the network. A two hidden layer deep neural network was designed, and their weights were trained by designing six hybrid models. These models are hybrid algorithms based on four optimization algorithms which are Genetic Algorithm, Artificial bee colony algorithm, firefly algorithm, and Jaya algorithm. Several metrics were used to evaluate the performance of the proposed models. This paper contributed to finding an effective network intrusion detection methodology and developing a deep neural network by building effective optimization algorithms. Where the proposed algorithms performed well with accuracy ranging from 77.177% to 85.077%. The proposed algorithms also achieved a low MSE loss rate close to zero with an MSE value of 9.99868e-05. Also, precision values range from 82 to 97%, and most of the proposed algorithms achieved high rates when calculating the sensitivity and specificity. The proposed models have contributed to finding a high-performance methodology for detecting intrusion on the network and contributed to proving that the hybrid algorithms used are effective and help to the optimization can be used in other studies.