# A Deep Learning Approach for Network Anomaly Detection Based on AMF-LSTM

Mingyi Zhu, Kejiang Ye, Yang Wang, Cheng-Zhong Xu

► To cite this version:

Mingyi Zhu, Kejiang Ye, Yang Wang, Cheng-Zhong Xu. A Deep Learning Approach for Network Anomaly Detection Based on AMF-LSTM. 15th IFIP International Conference on Network and Parallel Computing (NPC), Nov 2018, Muroran, Japan. pp.137-141, 10.1007/978-3-030-05677-3_13.hal-02279546

HAL Id: hal-02279546

https://inria.hal.science/hal-02279546

Submitted on 5 Sep 2019

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
A Deep Learning Approach for Network
Anomaly Detection based on AMF-LSTM

Mingyi Zhu, Kejiang Ye*, Yang Wang, Cheng-Zhong Xu

Shenzhen Institutes of Advanced Technology,
Chinese Academy of Sciences
{my.zhu, kj.ye, yang.wang1, cz.xu}@siat.ac.cn

**Abstract.** The Internet and computer networks are currently suffering from different security threats. This paper presents a new method called AMF-LSTM for abnormal traffic detection by using deep learning model. We use the statistical features of multi-flows rather than a single flow or the features extracted from log as the input to obtain temporal correlation between flows, and add an attention mechanism to the original LSTM to help the model learn which traffic flow has more contributions to the final results. Experiments show AMF-LSTM method has high accuracy and recall in anomaly type identification.

# 1 Introduction

The Internet and computer networks are currently suffering from different security threats [1]. The Global State of Information Security Survey 2015 [2] found there is a great increase in security incidents during the last several years. Network anomalies stand for a large fraction of the Internet traffic and compromise the performance of the network resources [1, 3]. With the growing network scale, the traditional methods face two problems: i) the processing speed is too slow, unable to cope with the massive network traffic data in today's Internet environments; ii) it may invade the user's privacy. This situation can be alleviated by using machine learning methods, which are successfully used in many other areas. However, most of the traditional machine learning methods always focus on the traffic itself and extract their own characteristics to detect the potential anomalies.

As we know the data transmitted in network is in the form of *flows*. There is always a temporal correlation between flows, which is also true for abnormal traffic in the network. In previous work, researchers focus on the characteristics of traffic itself, but ignore that many network anomalies have potential temporal correlation. RNN (Recurrent Neural Networks) is widely used in the fields that are time series related. Recently, there are some works using RNN and LSTM (Long-Short Term Memory) to detect abnormal traffic [4, 5], but they only use a single flow to repeat multiple times, which can only learn the relationship between themselves and cannot learn the relationship between different flows.

* Corresponding author
This paper presents an anomaly detection method using deep learning model based on AMF-LSTM. The proposed method has three important features: i) use the previous traffic flows as auxiliary features of the traffic to be detected; ii) use LSTM to find the hidden temporal correlation between these flows, and iii) use the attention mechanism to make model focus on the traffic and features that are useful for the results.

## 2 AMF-LSTM Model

We proposed an AMF-LSTM (Attention-base Multi-Flow LSTM) model for network anomaly detection. *Attention* means that our model is based on the attention mechanism [6]. *Multi-Flow* means that we not only use the characteristics of the current flow itself to detect the anomalies, but also use the previous traffic flows with temporal correlation to assist in detecting abnormal traffic. *LSTM* means the main body of our network is based on the long short-term memory networks [7]. Fig. 1 shows the structure of AMF-LSTM model.

<figure><img src="image_2.png" /><figcaption>Fig. 1. Structure of AMF-LSTM</figcaption></figure>

## 3 Experiment

We use CICIDS2017 [8] as the experimental dataset. The dataset contains benign and the most up-to-date common attacks, which resembles the true real-world data. The implemented attacks includes the most common attacks based on the 2016 McAfee report [9].

Our experiment mainly has the following hyperparameters: *n*, the number of flows are selected to detect the traffic; the *learning rate*, which is the step size of neural network for each learning; and the number of LSTM *hidden nodes*, which is the number of nodes that LSTM uses to learn.
<figure><img src="image_3.png" /><figcaption>Fig. 2. Accuracy and Recall of 8-Category Classification</figcaption></figure>

We first study the effect of learning rate and hidden nodes on the model accuracy, and find the best value of hidden nodes is 256, and the optimal learning rate is 0.0001. Then, we perform two sets of experiments with n = 10 and n = 20. The experimental results are similar, probably because the attention can focus on where it is needed. We compare the performance of our model with several classic machine learning algorithms, such as Naive Bayes, SVM, AdaBoost, MLP, and the original LSTM. The results of accuracy and recall comparison are shown in the Fig. 2. We can see that our model is significantly better than other machine learning algorithms, both in accuracy or recall.

We further conduct a deeper study on model with n = 10, lr = 0.0001, node_num = 256, which achieves the best performance. The evaluation metrics are shown in the Table 1. As we know, it is far more harmful for a system to judge abnormal traffic as normal traffic than to judge normal traffic as abnormal traffic. Therefore, we pay more attention to the value of recall. According to the table, our model can identify most of the anomalies correctly.

<table><caption>Table 1. The Results of Different Evaluation Metrics</caption><thead><tr><th></th><th>Precision</th><th>Recall</th><th>F1-score</th><th>Flows</th></tr></thead><tbody><tr><td>Normal</td><td>0.98</td><td>0.91</td><td>0.94</td><td>348631</td></tr><tr><td>DDoS</td><td>0.83</td><td>0.98</td><td>0.90</td><td>25606</td></tr><tr><td>PortScan</td><td>0.82</td><td>0.99</td><td>0.90</td><td>31786</td></tr><tr><td>BOT</td><td>0.05</td><td>0.75</td><td>0.10</td><td>394</td></tr><tr><td>Infiltration</td><td>0.00</td><td>0.75</td><td>0.01</td><td>8</td></tr><tr><td>Web Attack</td><td>0.04</td><td>0.81</td><td>0.07</td><td>436</td></tr><tr><td>Patator</td><td>0.38</td><td>0.53</td><td>0.44</td><td>2767</td></tr><tr><td>DoS</td><td>0.87</td><td>0.88</td><td>0.87</td><td>50532</td></tr></tbody></table>
## 4 Related Work

In prior studies, a number of approaches have been proposed for network anomaly detection. Sun et al. [10] present a survey of intrusion detection techniques for mobile ad-hoc networks (MANET) and wireless sensor networks (WSN). Sperotto et al. [11] explain the concepts of flow and classified attacks, and provide a detailed discussion of detection techniques. Abbes et al. [12] introduce an approach that uses decision trees with protocol analysis for effective intrusion detection. Khan et al. [13] use genetic algorithms to develop rules for network intrusion detection. There are also large number of methods using Neural Network. An example of ANN-based IDS is RT-UNNID [14]. Thilina et al. [15] propose a novel framework to perform intruder detection and analysis using deep learning nets and association rule mining. Yuan et al. [16] use the LSTM-CNN framework to find users anomalous behavior. Most recently, Zhu et al. [4] use CNN model for network anomaly detection and identification and achieve better performance than traditional machine learning algorithms. Although RNN [5] and LSTM [17] have been used to detect abnormal traffic before, they only use a single flow as the input of RNN and recurrent itself multiple times. In our opinion, they can only learn the relation in the traffic itself, and can not fully utilize the characteristics of RNN, which can learn the potential relations between different traffic.

## 5 Conclusion

This paper presents a method for abnormal traffic detection in the Internet by using deep learning model based on AMF-LSTM. We use the statistical features of multi-flows rather than a single flow as the input to obtain temporal correlation between flows, and add an attention mechanism to the original LSTM to help the model learn which traffic flow has more contributions to the result. Compared with other classic machine learning algorithms, our model achieves about 10% improvement in accuracy and recall on the multi-classification problems.

## Acknowledgment

This work is supported by the National Key R&D Program of China (No. 2018YFB1004804), National Natural Science Foundation of China (No. 61702492, U1401258), and Shenzhen Basic Research Program (No. JCYJ20170818153016513, JCYJ20170307164747920).

## References

[1] P. Garcia-Teodoro, J. Diaz-Verdejo, G. Maciá-Fernández, and E. Vázquez, "Anomaly-based network intrusion detection: Techniques, systems and challenges," *computers & security*, vol. 28, no. 1-2, pp. 18-28, 2009.
[2] M. Ahmed, A. N. Mahmood, and J. Hu, "A survey of network anomaly detection techniques," *Journal of Network and Computer Applications*, vol. 60, pp. 19-31, 2016.

[3] T. Benson, A. Akella, and D. A. Maltz, "Network traffic characteristics of data centers in the wild," in *Proceedings of the 10th ACM SIGCOMM conference on Internet measurement*, 2010, pp. 267-280.

[4] M. Zhu, K. Ye, and C.-Z. Xu, "Network anomaly detection and identification based on deep learning methods," in *International Conference on Cloud Computing*, 2018, pp. 219-234.

[5] C. Yin, Y. Zhu, J. Fei, and X. He, "A deep learning approach for intrusion detection using recurrent neural networks," *IEEE Access*, vol. 5, pp. 21954-21961, 2017.

[6] J. K. Chorowski, D. Bahdanau, D. Serdyuk, K. Cho, and Y. Bengio, "Attention-based models for speech recognition," in *Advances in neural information processing systems*, 2015, pp. 577-585.

[7] S. Hochreiter and J. Schmidhuber, "Long short-term memory," *Neural computation*, vol. 9, no. 8, pp. 1735-1780, 1997.

[8] "Intrusion detection evaluation dataset (cicids2017)," 2018. [Online]. Available: "http://www.unb.ca/cic/datasets/ids-2017.html"

[9] "Mcafee labs threats report," 2018. [Online]. Available: "https://www.mcafee.com/cn/security-awareness/articles/mcafee-labs-threats-report-mar-2016.aspx"

[10] B. Sun, L. Osborne, Y. Xiao, and S. Guizani, "Intrusion detection techniques in mobile ad hoc and wireless sensor networks," *IEEE Wireless Communications*, vol. 14, no. 5, 2007.

[11] A. Sperotto, G. Schaffrath, R. Sadre, C. Morariu, A. Pras, and B. Stiller, "An overview of ip flow-based intrusion detection." *IEEE Communications Surveys and Tutorials*, vol. 12, no. 3, pp. 343-356, 2010.

[12] T. Abbes, A. Bouhoula, and M. Rusinowitch, "Efficient decision tree for protocol analysis in intrusion detection," *International Journal of Security and Networks*, vol. 5, no. 4, pp. 220-235, 2010.

[13] M. S. A. Khan, "Rule based network intrusion detection using genetic algorithm," *International Journal of Computer Applications*, vol. 18, no. 8, pp. 26-29, 2011.

[14] M. Amini, R. Jalili, and H. R. Shahriari, "Rt-unnid: A practical solution to real-time network-based intrusion detection using unsupervised neural networks," *computers & security*, vol. 25, no. 6, pp. 459-468, 2006.

[15] A. Thilina, S. Attanayake, S. Samarakoon, D. Nawodya, L. Rupasinghe, N. Pathirage, T. Edirisinghe, and K. Krishnadeva, "Intruder detection using deep learning and association rule mining," in *Computer and Information Technology (CIT), 2016 IEEE International Conference on*, 2016, pp. 615-620.

[16] F. Yuan, Y. Cao, Y. Shang, Y. Liu, J. Tan, and B. Fang, "Insider threat detection with deep neural network," in *International Conference on Computational Science*, 2018, pp. 43-54.

[17] J. Kim, J. Kim, H. L. T. Thu, and H. Kim, "Long short term memory recurrent neural network classifier for intrusion detection," in *Platform Technology and Service (PlatCon), 2016 International Conference on*, 2016, pp. 1-5.