Title: A dual-stage deep learning model based on a sparse autoencoder and layered deep classifier for intrusion detection with imbalanced data

Authors: Omar Al-Harbi; Ahmed Hamed

Addresses: Applied College, Jazan University, Jazan, Saudi Arabia ' Applied College, Jazan University, Jazan, Saudi Arabia

Abstract: In cybersecurity, intrusion detection systems (IDSs) play a crucial role in identifying potential vulnerability exploits, thus reinforcing the network's defense infrastructure. Integrating machine learning models into IDS development has improved detection of complex and evolving intrusion patterns. However, imbalanced training data hampers model effectiveness, leading to classification inaccuracies and false alarms. This study proposes an IDS model using a dual-stage deep learning approach to address class imbalance. Initially, a sparse autoencoder (SAE) detects anomalies and extracts features. The subsequent stage employs a layered deep learning model combining convolutional neural network (CNN) and bidirectional long short-term memory (Bi-LSTM) architectures for multiclass classification. The model uses a cross-entropy loss function with proportional class weights. Evaluation on the NSL-KDD dataset demonstrates significant enhancements in overall accuracy, recall rate, and false positive rate, particularly for minority classes, showcasing its competitiveness against baseline models and other approaches.

Keywords: intrusion detection; autoencoder; anomaly detection; deep learning; convolutional neural network; CNN; bidirectional long short-term memory; Bi-LSTM.

DOI: 10.1504/IJSNET.2024.138918

International Journal of Sensor Networks, 2024 Vol.45 No.2, pp.74 - 86

Received: 20 Jan 2024
Accepted: 02 Apr 2024
Published online: 03 Jun 2024 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article