This paper investigates variant-gated recurrent units with encoders to preprocess packets for payload-aware intrusion detection. The variant-gated recurrent units include an encoded gated recurrent unit (E-GRU) and an encoded binarized gated recurrent unit (E-BinGRU). First, the originally collected traffic is split into packets that are segmented into fixed length. Next, the temporal features of the segmented packets with payloads and headers are extracted by the encoders of variant-gated recurrent units. Then, the performance of the intrusion detection system (IDS) is evaluated in terms of accuracy, detection rate, and false alarm rate. It is worth noting that we use the encoder to automatically preprocess network packets to obtain the features that accurately represent the network packets. The variant-gated recurrent units automatically learn network packet payload and header features to effectively improve the detection rate of the IDS. In addition, the E-BinGRU drastically reduces the memory size required and replaces most arithmetic operations with the bit-wise operations. E-GRU and E-BinGRU have never been used before in the network intrusion detection. The experimental results based on ISCX2012 show that the intrusion detection based on the investigated variant-gated recurrent units achieves higher accuracy and detection rates than three of the state-of-the-art methods. The accuracy rates of E-GRU and E-BinGRU are up to 99.9% and 99.7%, respectively, and the detection rates of E-GRU and E-BinGRU are up to 99.9% and 99.8%, respectively. The memory usage of E-GRU is approximately 32 times that of GRU.

Most existing studies on an unsupervised intrusion detection system (IDS) preprocessing ignore the relationship among packets. According to the homophily hypothesis, the local proximity structure in the similarity relational graph has similar embedding after preprocessing. To improve the performance of IDS by building a relationship among packets, we propose a packet2vec learning algorithm that extracts accurate local proximity features based on graph representation by adding penalty to node2vec. In this algorithm, we construct a relational graph G′ by using each packet as a node, calculate the cosine similarity between packets as edges, and then explore the low-order proximity of each packet via the penalty-based random walk in G′. We use the above algorithm as a preprocessing method to enhance the accuracy of unsupervised IDS by retaining the local proximity features of packets maximally. The original features of the packet are combined with the local proximity features as the input of a deep auto-encoder for IDS. Experiments based on ISCX2012 show that the proposal outperforms the state-of-the-art algorithms by 11.6% with respect to the accuracy of unsupervised IDS. It is the first time to introduce graph representation learning for packet-embedded preprocessing in the field of IDS.