An Intrusion Detection Model with Hierarchical Attention Mechanism

Abstract

Network security has always been a hot topic as security and reliability are vital to software and hardware. Network intrusion detection system (NIDS) is an effective solution to the identification of attacks in computer and communication systems. A necessary condition for high-quality intrusion detection is the gathering of useful and precise intrusion information. Machine learning, particularly deep learning, has achieved a lot of success in various fields of industry and academic due to its good ability of feature representation and extraction. In this paper, deep learning methods are integrated into the NIDS. The intrusion activity is regarded as a time-series event and a bidirectional gated recurrent unit (GRU) based network intrusion detection model with hierarchical attention mechanism is presented. The influence of different lengths of previous traffic on the performance is then studied. Some experiments are performed on the dataset UNSW-NB15, in which the proposed hierarchical attention model achieves satisfactory detection accuracy of more than 98.76% and a false alarm rate (FAR) of lower than 1.2%. An attention probability map to reflect the importance of features is then visualized using the attention mechanism. The visualization ability assists in providing an understanding of the varied importance of the same features for different traffic classes and to determine feature selection in the future.