Open Access

ARTICLE

Applying Stack Bidirectional LSTM Model to Intrusion Detection

Ziyong Ran¹, Desheng Zheng^{1, *}, Yanling Lai¹, Lulu Tian²

1 School of Computer Science, Research Center for Cyber Security, Southwest Petroleum University, Chengdu, 610500, China.
2 Brunel University London, Uxbridge, Middlesex, UB8 3PH, UK.

* Corresponding Author: Desheng Zheng. Email: .

Computers, Materials & Continua 2020, 65(1), 309-320. https://doi.org/10.32604/cmc.2020.010102

Received 11 February 2020; Accepted 01 May 2020; Issue published 23 July 2020

Abstract

Nowadays, Internet has become an indispensable part of daily life and is used in many fields. Due to the large amount of Internet traffic, computers are subject to various security threats, which may cause serious economic losses and even endanger national security. It is hoped that an effective security method can systematically classify intrusion data in order to avoid leakage of important data or misuse of data. As machine learning technology matures, deep learning is widely used in various industries. Combining deep learning with network security and intrusion detection is the current trend. In this paper, the problem of data classification in intrusion detection system is studied. We propose an intrusion detection model based on stack bidirectional long shortterm memory (LSTM), introduce stack bidirectional LSTM into the field of intrusion detection and apply it to the intrusion detection. In order to determine the appropriate parameters and structure of stack bidirectional LSTM network, we have carried out experiments on various network structures and parameters and analyzed the experimental results. The classic KDD Cup’1999 dataset was selected for experiments so that we can obtain convincing and comparable results. Experimental results derived from the KDD Cup’1999 dataset show that the network with three hidden layers containing 80 LSTM cells is superior to other algorithms in computational cost and detection performance due to stack bidirectional LSTM model’s ability to review time and correlate with connected records continuously. The experiment shows the effectiveness of stack bidirectional LSTM network in intrusion detection.

---

Keywords

---

Citations