Open Access

ARTICLE

MEM-TET: Improved Triplet Network for Intrusion Detection System

Weifei Wang¹, Jinguo Li^1,*, Na Zhao², Min Liu¹

1 College of Computer Science and Technology, Shanghai University of Electric Power, Shanghai, 201306, China
2 National Pilot School of Software, Yunnan University, Kunming, 650504, China

* Corresponding Author: Jinguo Li. Email:

(This article belongs to this Special Issue: Multimedia Encryption and Information Security)

Computers, Materials & Continua 2023, 76(1), 471-487. https://doi.org/10.32604/cmc.2023.039733

Received 13 February 2023; Accepted 17 April 2023; Issue published 08 June 2023

Abstract

With the advancement of network communication technology, network traffic shows explosive growth. Consequently, network attacks occur frequently. Network intrusion detection systems are still the primary means of detecting attacks. However, two challenges continue to stymie the development of a viable network intrusion detection system: imbalanced training data and new undiscovered attacks. Therefore, this study proposes a unique deep learning-based intrusion detection method. We use two independent in-memory autoencoders trained on regular network traffic and attacks to capture the dynamic relationship between traffic features in the presence of unbalanced training data. Then the original data is fed into the triplet network by forming a triplet with the data reconstructed from the two encoders to train. Finally, the distance relationship between the triples determines whether the traffic is an attack. In addition, to improve the accuracy of detecting unknown attacks, this research proposes an improved triplet loss function that is used to pull the distances of the same class closer while pushing the distances belonging to different classes farther in the learned feature space. The proposed approach’s effectiveness, stability, and significance are evaluated against advanced models on the Android Adware and General Malware Dataset (AAGM17), Knowledge Discovery and Data Mining Cup 1999 (KDDCUP99), Canadian Institute for Cybersecurity Group’s Intrusion Detection Evaluation Dataset (CICIDS2017), UNSW-NB15, Network Security Lab-Knowledge Discovery and Data Mining (NSL-KDD) datasets. The achieved results confirmed the superiority of the proposed method for the task of network intrusion detection.

---

Keywords

---