Deep learning has made good progress in intrusion detection field due to its powerful adaptive learning capability, but deep learning computes more and more slowly as model layers deepen, and existing deep learning models rely on datasets with artificially designed features, which in turn makes the models need to be deepened to learn the complete features, such data also makes it difficult to generalize the trained model. To solve these problems, we propose a method for extracting packet bytes from PCAP files as features to enable the models to learn the original features. Then propose a deep learning model IDPnet, which mainly employs one dimensional depthwise separable convolution, it regards each packet as channels, learns features through depthwise and pointwise convolution hierarchically, which greatly reduces the inference time while improving the accuracy compared to common CNN models that using converted grayscale image as input. Finally, we conduct transfer learning on IoT dataset, demonstrating that pre-trained model can be reused on data from different devices and protocols using packet data as features, reducing training time.
Paper
Full text
Intrusion detection using deep learning on packet data
Semantic Scholar · Computer Science · 2022
Abstract
Deep learning has made good progress in intrusion detection field due to its powerful adaptive learning capability, but deep learning computes more and more slowly as model layers deepen, and existing deep learning models rely on datasets with artificially designed features, which in turn makes the models need to be deepened to learn the complete features, such data also makes it difficult to generalize the trained model. To solve these problems, we propose a method for extracting packet bytes from PCAP files as features to enable the models to learn the original features. Then propose a deep learning model IDPnet, which mainly employs one dimensional depthwise separable convolution, it regards each packet as channels, learns features through depthwise and pointwise convolution hierarchically, which greatly reduces the inference time while improving the accuracy compared to common CNN models that using converted grayscale image as input. Finally, we conduct transfer learning on IoT dataset, demonstrating that pre-trained model can be reused on data from different devices and protocols using packet data as features, reducing training time.