Traffic classification is the first step for network anomaly detection or network based intrusion detection system and plays an important role in network security domain. In this paper we first presented a new taxonomy of traffic classification from an artificial intelligence perspective, and then proposed a malware traffic classification method using convolutional neural network by taking traffic data as images. This method needed no hand-designed features but directly took raw traffic as input data of classifier. To the best of our knowledge this interesting attempt is the first time of applying representation learning approach to malware traffic classification using raw traffic data. We determined that the best type of traffic representation is session with all layers through eight experiments. The method is validated in two scenarios including three types of classifiers and the experiment results show that our proposed method can satisfy the accuracy requirement of practical application.

The development of an anomaly-based intrusion detection system (IDS) is a primary research direction in the field of intrusion detection. An IDS learns normal and anomalous behavior by analyzing network traffic and can detect unknown and new attacks. However, the performance of an IDS is highly dependent on feature design, and designing a feature set that can accurately characterize network traffic is still an ongoing research issue. Anomaly-based IDSs also have the problem of a high false alarm rate (FAR), which seriously restricts their practical applications. In this paper, we propose a novel IDS called the hierarchical spatial-temporal features-based intrusion detection system (HAST-IDS), which first learns the low-level spatial features of network traffic using deep convolutional neural networks (CNNs) and then learns high-level temporal features using long short-term memory networks. The entire process of feature learning is completed by the deep neural networks automatically; no feature engineering techniques are required. The automatically learned traffic features effectively reduce the FAR. The standard DARPA1998 and ISCX2012 data sets are used to evaluate the performance of the proposed system. The experimental results show that the HAST-IDS outperforms other published approaches in terms of accuracy, detection rate, and FAR, which successfully demonstrates its effectiveness in both feature learning and FAR reduction.

This paper investigates variant-gated recurrent units with encoders to preprocess packets for payload-aware intrusion detection. The variant-gated recurrent units include an encoded gated recurrent unit (E-GRU) and an encoded binarized gated recurrent unit (E-BinGRU). First, the originally collected traffic is split into packets that are segmented into fixed length. Next, the temporal features of the segmented packets with payloads and headers are extracted by the encoders of variant-gated recurrent units. Then, the performance of the intrusion detection system (IDS) is evaluated in terms of accuracy, detection rate, and false alarm rate. It is worth noting that we use the encoder to automatically preprocess network packets to obtain the features that accurately represent the network packets. The variant-gated recurrent units automatically learn network packet payload and header features to effectively improve the detection rate of the IDS. In addition, the E-BinGRU drastically reduces the memory size required and replaces most arithmetic operations with the bit-wise operations. E-GRU and E-BinGRU have never been used before in the network intrusion detection. The experimental results based on ISCX2012 show that the intrusion detection based on the investigated variant-gated recurrent units achieves higher accuracy and detection rates than three of the state-of-the-art methods. The accuracy rates of E-GRU and E-BinGRU are up to 99.9% and 99.7%, respectively, and the detection rates of E-GRU and E-BinGRU are up to 99.9% and 99.8%, respectively. The memory usage of E-GRU is approximately 32 times that of GRU.

The development of computer and network technology has provided convenience to our daily life, however, attack and intrusion in network emerge endlessly. Intrusion Detection System (IDS) has been developed to confront network attacks. As a result, the research of IDS is one of the most popular fields in recent years. This paper proposes a Gradient Boosting Decision Tree (GBDT)-paralleled quadratic ensemble learning method for intrusion detection system. We use GBDT to deal with the spatial part of traffic data and use Gated Recurrent Unit (GRU) model with special modification for network traffic to deal with temporal data. Then, in order to combine the spatial feature and temporal feature, we fuse GBDT model and GRU model to make a quadratic ensemble model as our final intrusion detection system. The experimental results based on CICIDS2017 dataset show that the advanced spatial-temporal intrusion detection system based on ensemble learning achieves better accuracy, recall, precision and F1 score than the state-of-the-art methods. The accuracies of detecting benign, port scan, Distributed Denial of Service (DDoS), infiltration and web attack traffic are up to 99.9%, 99.9%, 99.9%, 99.9%, and 99.9%, respectively. We also use our method in Information-Centric Networking (ICN) dataset and the results show our method achieves much better performance compared with existing methods.

In the studies of cybersecurity, malicious traffic detection is attracting more and more attention for its capability of detecting attacks. Almost all of the intrusion detection methods based on deep learning have poor data processing capacity with the increase of the data length. Most intrusion detection methods can only handle the header part of the traffic and omit valuable information from the payload, so they can not detect the malicious traffic when the hacker hides attack behavior in the payload. In this article, we propose an attention model that can process network traffic flow with adjustable length to detect payload-based attacks. Furthermore, we design a Flow Wasserstein GAN model to generate new network traffic data from the original data sets to enhance network packet data and protect user privacy. Our model has a hierarchical structure to build representations of bytes and packets on two levels. Moreover, two levels of attention mechanisms enable the model to pay attention to more important content when constructing the flow representation. The experiments based on the ISCX-2012 and ISCX-2017 datasets prove that the proposed model has higher performance in accuracy and true positive rate (TPR) than four state-of-the-art deep learning methods. The experiment shows that our model outperforms the existing HSAT-IDS in detection of the generated packets.

In order to improve future network performance, this paper proposes scalable intelligence-enabled networking (SIEN) with eliminating traffic redundancy for audio-visual-tactile Internet in 5G scenarios such as eMBB, URLLC and mMTC. The SIEN consists of an intelligent management plane (ImP), an intelligence-enabled plane (IeP), a control plane and a user plane. For the ImP, the containers with decision execution are constructed by a novel graph algorithm to organize objects such as network elements and resource partitions. For the IeP, a novel learning system is designed with decision making using a congruity function for generalization and personalization in the presence of imbalanced, conflicting and partial data. For the control plane, a scheme of identifier-locator mapping is designed by referring to information-centric networking and software-defined networking. For the user plane, the registrations, requests and data are forwarded to implement the SIEN and test its performance. The evaluation shows the SIEN outperforms four state-of-the-art techniques for redundant traffic reduction by up to 46.04% based on a mix of assumption, simulation and proof-of-concept implementation for audio-visual-tactile Internet multimedia service. To confirm the validity, the best case and the worst case for traffic offloading are tested with the data rate, the latency and the density. The evaluation only focused on the scalability issue, while the SIEN would be beneficial to improve more issues such as inter-domain security, ultra-low latency, on-demand mobility, multi-homing routing, and cross-layer feature incongruity.