Intrusion Detection via Wide and Deep Model

Abstract

Intrusion detection system is designed to detect threats and attacks, which are especially important in nowadays’ constantly emerging information security incidents. There has been a lot of work devoted to realizing anomaly detection mode of intrusion detection via deep learning, since deep learning becomes a research hot spot. However, there is rarely work that uses different deep learning networks as hybrid architecture to benefit the advantages of each special part. In this paper, we are inspired by the Google’s Wide & Deep model which is proposed to combine memorization with generalization via different networks. We propose a framework to use Wide & Deep model for intrusion detection. To get comprehensive categorical representations of continuous features, we use a density-based clustering (DBSCAN) to convert the KDD’99 (formula presented)NSL_KDD format features into sparse categorical feature representations. A widely used and popular NSL_KDD dataset is used for evaluating the proposed model. A comprehensive empirical evaluation with hypothesis testing demonstrates that the revised Wide & Deep framework outperforms the separated part alone. Compared with other machine learning base line methods and advanced deep learning methods, the proposed model outperforms the baseline results and achieves a steady and promising performance in tests with different levels.