Intrusion Detection System based on Packet Payload Analysis using Transformer (패킷 페이로드 분석을 활용한 트랜스포머 기반 침입탐지시스템)

Woo-Seung Park (박우승); Gun-Nam Kim (김건남); Soojin Lee (이수진)

doi:10.9708/jksci.2023.28.11.081

Intrusion Detection System based on Packet Payload Analysis using Transformer

Journal of The Korea Society of Computer and Information
Abbr : JKSCI
2023, 28(11), pp.81-87
DOI : 10.9708/jksci.2023.28.11.081
Publisher : The Korean Society Of Computer And Information
Research Area : Engineering > Computer Science
Received : October 18, 2023
Accepted : November 17, 2023
Published : November 30, 2023

Woo-Seung Park ¹, Gun-Nam Kim ¹, Soojin Lee ¹

¹국방대학교

Accredited

ABSTRACT

Intrusion detection systems that learn metadata of network packets have been proposed recently. However these approaches require time to analyze packets to generate metadata for model learning, and time to pre-process metadata before learning. In addition, models that have learned specific metadata cannot detect intrusion by using original packets flowing into the network as they are. To address the problem, this paper propose a natural language processing-based intrusion detection system that detects intrusions by learning the packet payload as a single sentence without an additional conversion process. To verify the performance of our approach, we utilized the UNSW-NB15 and Transformer models. First, the PCAP files of the dataset were labeled, and then two Transformer (BERT, DistilBERT) models were trained directly in the form of sentences to analyze the detection performance. The experimental results showed that the binary classification accuracy was 99.03% and 99.05%, respectively, which is similar or superior to the detection performance of the techniques proposed in previous studies. Multi-class classification showed better performance with 86.63% and 86.36%, respectively.

KEYWORDS

Natural Language Processing, IDS, Packet Payload, Transformer, UNSW-NB15

Citation status

* References for papers published after 2023 are currently being built.

[journal] 김건남 / 2023 / Intrusion Detection System based on Packet Payload Analysis using LightGBM / 한국컴퓨터정보학회논문지 / 한국컴퓨터정보학회 28(6) : 47~54

[confproc] N. Moustafa / 2015 / UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set) / 2015 Military Communications and Information Systems Conference (MilCIS) : 1~6

[web] Canadian Institute for Cybersecurity / UNSW-NB15 Data set / https://www.unsw.adfa.edu.au/unsw-canberra-cyber/cybersecurity/ADFA-NB15-Datasets/

[web] Australian Center for Cyber Security / NSL-KDD dataset / https://www.unb.ca/cic/datasets/nsl.html

[journal] Sydney M. Kasongo / 2020 / Performance Analysis of Intrusion Detection Systems Using a Feature Selection Method on the UNSW-NB15 Dataset / Journal of Big Data / Springer Science and Business Media LLC 7(105)

[journal] J. Vimalrosy / 2022 / OSS-RF: INTRUSION DETECTION USING OPTIMIZED SINE SWARM BASED RANDOM FOREST CLASSIFIER ON UNSW-NB15DATASET / IJTPE Journal 14 : 275~283

[confproc] M. H. Kabir / 2022 / Network Intrusion Detection Using UNSW-NB15 Dataset: Stacking Machine Learning Based Approach / 2022International Conference on Advancement in Electrical and Electronic Engineering (ICAEEE) : 1~6

[journal] Nour Moustafa / 2016 / The evaluation of Network Anomaly Detection Systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set / Information Security Journal: A Global Perspective / Informa UK Limited 25(1-3) : 18~31

[journal] Abhijit Das / 2022 / Anomaly-based Network Intrusion Detection using Ensemble Machine Learning Approach / International Journal of Advanced Computer Science and Applications / The Science and Information Organization 13(2) : 635~645

[confproc] D. Jing / 2019 / SVM Based Network Intrusion Detection for the UNSW-NB15 Dataset / 2019 IEEE 13th International Conference on ASIC (ASICON) : 1~4

[journal] Fares Meghdouri / 2018 / Analysis of Lightweight Feature Vectors for Attack Detection in Network Traffic / Applied Sciences / MDPI AG 8(11) : 2196~

[journal] Zihan Wu / 2022 / RTIDS: A Robust Transformer-Based Approach for Intrusion Detection System / IEEE Access / Institute of Electrical and Electronics Engineers (IEEE) 10 : 64375~64387

[other] Y. G. Yang / 2022 / Intrusion detection: A model based on the improved vision transformer / National Natural Science Foundation of China

[confproc] Ju-wan Lim / 2022 / Performance comparison of network anomaly detection using BERT, LSTM and GRU / KICS : 1268~1269

[confproc] Y. A. Farrukh / 2022 / Payload-Byte: A Tool for Extracting and Labeling Packet Capture Files of Modern Network Intrusion Detection Datasets : 58~67

[other] Vaswani / 2017 / Attention is All you Need / NIPS

[confproc] J. Devlin / 2019 / BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding / 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies 1 : 4171~4186

[web] V. sanh / 2020 / DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter / 10.48550/arXiv.1910.01108

[other] Yinhan Liu / 2019 / RoBERTa:A Robustly Optimized BERT Pretraining Approach / Computation and Language

[journal] Zhenzhong Lan / 2020 / ALBERT: A Lite BERT for Self-supervised Learning of Language Representations / Computation and Language 6

[other] Zhilin Yang / 2019 / XLNet: Generalized Autoregressive Pretraining for Language Understanding / NeurIPS

KJCKorea
Journal Central

Journal of The Korea Society of Computer and Information 2023 KCI Impact Factor : 0.65

Intrusion Detection System based on Packet Payload Analysis using Transformer

ABSTRACT

KEYWORDS

Citation status

* References for papers published after 2023 are currently being built.

Journal of The Korea Society of Computer and Information 2023 KCI Impact Factor : 0.65

Intrusion Detection System based on Packet Payload Analysis using Transformer

ABSTRACT

KEYWORDS

Statistics

Tools

Issue List

Citation status

KCI Citation Counts (0)

REFERENCES (21) * References for papers published after 2023 are currently being built.

Search PDF

Citation

* References for papers published after 2023 are currently being built.