Tuning CNN input layout for IDS with genetic algorithms

Abstract

Intrusion Detection Systems (IDS) are implemented by service providers and network operators to monitor and detect attacks. Many machine learning algorithms, stand-alone or combined, have been proposed, including different types of Artificial Neural Networks (ANN). This work evaluates a Convolutional Neural Network (CNN), created for image classification, as an IDS that can be deployed in a router, which has not been evaluated previously. The layout of the features in the input matrix of the CNN is relevant. A Genetic Algorithm (GA) is used to find a high-quality solution by rearranging the layout of the input features, reducing the features if required. The GA improves the capacity of intrusion detection from 0.71 to 0.77 for normalized input featuress, similar to existing algorithms. For scenarios where data normalization is not possible, many input layouts are useless. The GA finds a solution with an intrusion detection capacity of 0.73.