DeepIoT.IDS: hybrid deep learning for enhancing IoT network intrusion detection

Abstract

With an increasing number of services connected to the internet, including cloud computing and Internet of Things (IoT) systems, the prevention of cyberattacks has become more challenging due to the high dimensionality of the network traffic data and access points. Recently, researchers have suggested deep learning (DL) algorithms to define intrusion features through training empirical data and learning anomaly patterns of attacks. However, due to the high dynamics and imbalanced nature of the data, the existing DL classifiers are not completely effective at distinguishing between abnormal and normal behavior line connections for modern networks. Therefore, it is important to design a self-adaptive model for an intrusion detection system (IDS) to improve the detection of attacks. Consequently, in this paper, a novel hybrid weighted deep belief network (HW-DBN) algorithm is proposed for building an efficient and reliable IDS (DeepIoT.IDS) model to detect existing and novel cyberattacks. The HW-DBN algorithm integrates an improved Gaussian-Bernoulli restricted Boltzmann machine (Deep GB-RBM) feature learning operator with a weighted deep neural networks (WDNN) classifier. The CICIDS2017 dataset is selected to evaluate the DeepIoT.IDS model as it contains multiple types of attacks, complex data patterns, noise values, and imbalanced classes. We have compared the performance of the DeepIoT.IDS model with three recent models. The results show the DeepIoT.IDS model outperforms the three other models by achieving a higher detection accuracy of 99.38% and 99.99% for web attack and bot attack scenarios, respectively. Furthermore, it can detect the occurrence of low-frequency attacks that are undetectable by other models.