# Deep Learning for Intrusion Detection Systems (IDSs) in Time Series Data +
## 7 Conclusions  
In this study, we re-examined the conventional approach of intrusion detection systems based on machine learning and redefined the problem as a time series prediction task. Our results demonstrate that our proposed methodology is capable of proactive operation rather than merely reacting to security breaches, achieving an F1 score within a margin of 1% compared to the real-time approach and an AUC score that is lower by only 3%. By embracing the time series prediction approach, we acknowledge the dynamic nature of network threats and the need for a proactive defense strategy. This shift in perspective allows us to anticipate and counteract emerging attack techniques, thereby staying one step ahead of malicious actors. Through our research, we aim to contribute to the continuous improvement of intrusion detection systems, ensuring the safety and security of our interconnected digital world. The results indicate that there is a natural trade-off between computation complexity and window size, \(W\), so the choice must be tailored to a specific use case. Based on our experiments, there is an additional trade-off between feature sets and performance, where fewer features result in faster training/inference but also smaller accuracy. Furthermore, we reveal that analyzing the overall traffic of a network (network grouping) can uncover patterns not directly linked to specific nodes, such as those associated with IP, providing valuable insights into intrusion detection. We also test many architectural approaches and conclude with a complex time series prediction model that achieves robust metric scores.  
In the future, we will aim to validate our approach further by employing more IDS datasets to further support our claims. We also plan to evaluate the performance of a model trained on one dataset but tested on another dataset with the same features to assess cross-dataset validation. Lastly, we plan to test our methodology in both centralized and federated learning paradigms since such a model would benefit from diverse data gathered from multiple devices.  
Conceptualization, K.P., N.N. and A.P.; methodology, K.P.; software, K.P.; validation, K.P. and A.M.; formal analysis, K.P.; investigation, K.P.; resources, S.B.; data curation, K.P.; writing--original draft preparation, K.P., A.P. and N.N. and A.M.; writing--review and editing, K.P.; visualization, K.P.; supervision, T.Z.; project administration, T.Z.; funding acquisition, T.Z. All authors have read and agreed to the published version of the manuscript.  
This work was funded by the H2020 CyberSEAS project, contract no. 101020560, within the H2020 Framework program of the European Commission.  
The dataset used for this article is available online at [[https://research.unsw.edu.au/projects/unsw-nb15-dataset](https://research.unsw.edu.au/projects/unsw-nb15-dataset)]([https://research.unsw.edu.au/projects/unsw-nb15-dataset](https://research.unsw.edu.au/projects/unsw-nb15-dataset)) 23 November 2023.  
We acknowledge the equal contributions of all authors.  
All authors are employees of Synelixis Solutions S.A. Corresponding author declares that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.