Multi-Valued Neutrosophic Convolutional LSTM for Intrusion Detection

Abstract

Cyber security is an essential area of study because of the positive effects that networks have on modern society. As it becomes simpler for cybercriminals to launch novel assaults, the scale and complexity of today's networks continue to grow. Therefore, it is crucial to create an efficient instruction detection system (IDS) capable of constantly monitoring network traffic for suspicious activity and issuing alerts as necessary. Several researchers have employed machine learning (ML) and deep learning (DL) techniques to create an effective IDS. Amongst, an effective IDS detection model convolutional neural network (CNN)- long short term memory (LSTM extracts temporal and geographical aspects of network traffic to lower the false alarm rate (FAR) and raise the detection rate (DR). However, the epistemic uncertainty in intrusion data affect the efficiency of CNN-LSTM model. This paper handle uncertainty information by proposing a multivalued neutrosophic convolutional LSTM (MVN-ConvLSTM) which extracts different deep features. MVN-ConvLSTM uses a neutrosophic set (NS) which considers truth (T), indeterminacy (I), and falsity (F) memberships of every features. First, the intrusion features are mapped to NS domain as six sets, positive degree of truth-membership (TA), positive degree of falsity membership (FA), Positive degree of indeterminate towards falsity and indeterminate towards truth membership (IA), negative degree of truth-membership (TB), negative degree of falsity membership (IB), and negative degree of indeterminate towards falsity and indeterminate towards truth membership (IB). Next, an MVN-ConvLSTM is generated with four parallel paths, two of which take input from T and two from I, and a suitable combination of these paths is used to produce the output. The weights of the neural network are updated in four different directions at once using a back propagation approach. The efficiency of MVN-ConvLSTM to handle uncertainty in intrusion dataset is proved by comparing conventional CNN models which provides lower FAR and high DR. Finally, the test results show that the MVN-ConvLSTM achieves accuracy value of 94.63%, 92.84% and 91.84% on three different datasets CIC-IDS2018, WSN-DS and UNSW-NB15.