CNNBi-LSTM-GCN-ATN: Combining multifolddeep learning models with attention methodology for an enhanced network intrusion detection system

Abstract

Network systems and data have changed quickly as a result of recent developments in the communication technologies. New threats create security risksthat are extremely difficult to identify intrusions. An intruder will inevitably launch many network attacks. Ensuring robust security is a growing challenge in the era of increasingly complex cyber threats and high-volume network environments. Traditional system uses shallow ML, which has limited abilities to detect novel threats. A novel multi-model DL architecture is proposed by integrating CNN, Bi-LSTM,GCN models, and attention mechanism approach.In the proposed architecture, the packetand flow-level patterns are extracted from the network raw data by the CNN layers for spatial representations. The Bi-LSTM layers process the extracted spatial features to model temporal dependencies. A bidirectional time flow behavior is performed to enable accurate identification of attacks. Then, feature extraction is performed using spatial and temporal approaches. The converted data is mapped into a graph structure. The nodes in the graph denotes the communication sessions (entities) and the edges in the graph denotes the encoded flow interactions (similarities). Next, GCN layer is used to train the graph structured representations. An attention mechanism approach is merged to enhance the model’s discriminative capability.The model is assessed for accuracy, capability and the ability to handle new attacks. The results of the proposed CNNBi-LSTM-GCN-ATNmodel outperforms the existing DL architectures in overall accuracy and identification of different attack categories.