当前位置: X-MOL 学术Comput. Electr. Eng. › 论文详情
Our official English website, www.x-mol.net, welcomes your feedback! (Note: you will need to create a separate account there.)
Deep learning-based feature extraction and optimizing pattern matching for intrusion detection using finite state machine
Computers & Electrical Engineering ( IF 4.0 ) Pub Date : 2021-03-26 , DOI: 10.1016/j.compeleceng.2021.107094
Junaid Shabbir Abbasi , Faisal Bashir , Kashif Naseer Qureshi , Muhammad Najam ul Islam , Gwanggil Jeon

Deep learning has gained popularity for feature extraction in the field of Network Intrusion Detection and Prevention System (NIDPS) to extract the patterns matching and secure the networks by detecting the unknown and malicious activities. The malicious activities and security attacks are disturbing the normal operations of networks. The new attacks are difficult to monitor due to their new features and pattern types. Different types of methods have been adopted for feature extraction and pattern matching. Deep learning is one of them and subfield of machine learning where it solves the optimization issues layer-wise by looking at the deep structure. On the other hand, pattern matching is another considerable method for intrusion detection due to its variety of applications. However, pattern matching methods are consuming more than 70% of the total running time and cause overhead. In this paper, we propose two methods including Deep Learning-based Feature Extraction (DLFE) and Optimization of Pattern Matching (OPM) for NIDPS systems to optimizes the pattern matching engine in intrusion detection. The experiments are performed by using the snort ruleset for pattern matching and obtained the results. The experiment results show the better performance of proposed methods in terms of time, throughput, and memory.



中文翻译:

基于深度学习的特征提取和模式匹配优化用于有限状态机的入侵检测

深度学习在网络入侵检测和防御系统(NIDPS)领域中的特征提取中很受欢迎,它可以通过检测未知和恶意活动来提取匹配的模式并保护网络安全。恶意活动和安全攻击正在干扰网络的正常运行。由于新攻击的新功能和特征码类型,因此很难对其进行监视。特征提取和模式匹配已采用了不同类型的方法。深度学习是机器学习的其中一个子领域,它通过查看深度结构来逐层解决优化问题。另一方面,由于模式匹配的应用范围很广,因此它是另一种重要的入侵检测方法。然而,模式匹配方法消耗了总运行时间的70%以上,并导致开销。在本文中,我们提出了两种方法,包括针对NIDPS系统的基于深度学习的特征提取(DLFE)和模式匹配优化(OPM),以优化入侵检测中的模式匹配引擎。通过使用snort规则集进行模式匹配来进行实验,并获得了结果。实验结果表明,所提方法在时间,吞吐量和内存方面都具有较好的性能。通过使用snort规则集进行模式匹配来进行实验,并获得了结果。实验结果表明,所提方法在时间,吞吐量和内存方面都具有较好的性能。通过使用snort规则集进行模式匹配来进行实验,并获得了结果。实验结果表明,所提方法在时间,吞吐量和内存方面都具有较好的性能。

更新日期:2021-03-27
down
wechat
bug