Chapter 14: Developing a Near-real Time AI-based Network Intrusion Detection System:

The rapid growth of the Internet in recent years has allowed technological advancements, including communication fields by enabling global connectivity in real time, which has broken down geographical barriers and allows communication with anyone, anywhere, at any time. The size of the network data and the corresponding information that gets transmitted though communication channels have significantly increased as a result of these improvements, while technological advancement creates concerns regarding the security of data during transactions, since even simple transactions contain sensitive information. The security of the data is constantly under threat, while cyber-crimes are evolving to be more effective and complicated to detect. However, cyber security techniques are under constant enhancement as well. Researchers are investigating and employing a variety of approaches to secure computers and networks in order to protect systems and data. Among the suggested approaches resides the development of systems that analyze the network, monitor for signs of malicious activity, and trigger an alert when they detect potential threats, namely Network Intrusion Detection Systems (NIDSs). Machine Learning (ML) and Deep Learning (DL) techniques were introduced into NIDSs to enhance detection efficacy and potentially identify unknown attacks, namely zero-day attacks. ML and DL models are trained with network traffic data in order to learn to identify patterns of malicious and benign activity. A challenge of this approach is that ML and DL models should always be trained and tested with modern network traffic in order to achieve improved detection results, while models should also be evaluated in realistic network environments. Although there are numerous studies across the literature that propose and develop NIDS solutions, the majority of them don’t deploy the model after training into a realistic network for validation or they use outdated datasets for the training of the model. This chapter proposes a NIDS that incorporates a DL model and an in-house dataset developed, which portrays modern network traffic. The dataset was typically divided into training and testing sets and ML metrics such as Accuracy, Recall, Precision and F1-score were used to evaluate the models’ performance during the training and testing phase, while the NIDS was also deployed in a realistic network and was evaluated in near-real time conditions. The proposed solution showcased promising results by achieving over 97% rate on the accuracy evaluation metric during the training phase and over 90% when deployed in a realistic network environment and evaluated during a near-real time scenario.

Cybercrime is defined as any illegal activity performed through the internet utilizing networks or electronic devices with the intention of inflicting damages to the system’s infrastructure, tampering with the data and intercepting information among others. Such crimes include data breaches, fraud, identity theft, computer viruses, and more. As reported in the annual report by the European Union Agency for Cybersecurity (ENISA) [1] for 2023, an increase has been observed in the quantity as well as consequences of cyberattacks. In accordance with ENISA, throughout the halfway of year 2022, there were less than a thousand cyberattacks reported global and in the European region; however, during the first half of 2023, this number rose to more than 2500 reported cyberattack incidents. Moreover, according to [2], the inflicted damage worth will be 9.5 trillion USD globally in 2024 and the cost will grow by 15 percentage for the year of 2025, reaching 10.5 trillion USD.

Researchers are working to develop solutions to this global pandemic of cybercrime. Among the main goals is to develop systems that monitor for potential malicious activities that target networks or connected devices. Intrusion Detection Systems (IDS) [3] have been the main topic of several studies, since this approach shows great potential to protect against and/or mitigate a number of cybercrime-related issues. These systems monitor the network for indications of malicious activity and trigger an alert when they identify potential risks. They are divided into two categories: Network intrusion detection systems (NIDS), and Host Intrusion Detection Systems (HIDS). NIDSs [4] monitor for malicious activity and unauthorized access on networks, while HIDSs [4] monitor on devices that produce logs or metrics, seeking indicators of suspicious behavior to identify abnormal activities.

NIDS have two methods to detect intrusions: Signature-Based [3] and Anomaly-Based[3].Systemsthatmaintainintrusionsignaturesintheirdatabaseandcompare incoming traffic are referred to as signature-based detection systems. However, this type of system has a disadvantage as it cannot identify unknown intrusion traffic that may constitute a cyber-attack. Conversely, anomaly-based detection methods are able to detect and notify regarding unknown intrusion traffic because they can use various Machine Learning (ML) and Deep Learning (DL) algorithms that are trained with a network dataset to identify patterns of malicious traffic. ML as a subset of Artificial Intelligence (AI) utilizes mathematical algorithms in many research domains [5]. This method can acquire knowledge from the data and generalize to unfamiliar data, thus perform tasks without having previously been directly programmed. However, this method has also some drawbacks, such as the false positive alarm. This alert occurs when the system detects suspicious behavior and responds accordingly, however the identification of this behavior as malicious is a false alarm. In order to address this issue, the Deep Learning (DL) technique has been developed as a subset of ML that is manufactured with Neural Networks (NNs).

NNs are artificial neurons that aim to imitate the complicated procedure of decision-making by taking inspiration from the architecture and functions of the human brain. DL models are capable of simulating a decision similar to the human brain, adapting to novel patterns and continuously learn from their failures [5]. One of the most recent and effective methods to detect intrusions and novel attacks in NIDS is the utilization of DL methods. The term “novel attacks” refers to unknown or new threats that have the ability to exploit vulnerabilities in the network or in the machines. In addition, attackers often attempt to “hide” their traces, but by employing DL techniques in NIDS patterns and behaviors that are being suggestive of cyberattacks can be identified.

ML and DL enable NIDSs to identify patterns that serve as normal and malicious behavior traffic baseline of the system and, therefore, detect anomalies. However, the drawback of this method is that traffic may be misclassified as benign or malicious, respectively. In addition, most of the case studies that utilize ML and DL, adopt an outdated network traffic dataset for the training of the models while they lack deploying the NIDSs in realistic environments for evaluating Near-Real Time network intrusion detection, such as in [6] and [7].

Considering all the previously mentioned statistics and reported issues from [2] and [1] as well as current studies and solutions identified in the literature, this chapter introduces an Anomaly-based NIDS, since this detection method can identify intrusions and novel attacks. The proposed solution utilizes the DL capabilities of Convolutional Neural Networks (CNN), such as the generalization to new unseen data, the scalability to process very large datasets and the decision-making complexity in real time, to make predictions about the network traffic in near-real time. A recent in-house developed dataset was utilized for the training ofthe CNN model. This dataset reflects modern network activity and contains recent traffic patterns, behaviors, and threats with the aim to accomplish developing a more robust and accurate model that can address some ofthe modern difficulties that cybersecurity in general and network intrusion detection in particular encounter.

The remainder ofthis chapter is structured as follows: the State ofthe Art is presented in sub-chapter 14.2, the implementation ofthe proposed NIDS is described in sub-chapter ??, the Model Evaluation Process is covered in sub-chapter ??, and the Conclusion and Future Work Plans are presented in sub-chapter ??.

Malicious network attacks become complicated to detect due to the continuous progress ofcyberthreats. A wide range ofsoftware and platforms begin to utilize the ML capabilities, as they enhance their ability to detect cyberthreats. The dataset that trains an ML has a major impact on how efficiently the model detects the intrusions. Identifying those intrusions in the network at the time that they occur is one ofthe most essential parts to be provided by the ML models. In this section, a review ofthe literature is presented regarding various ML and DL models trained with a variety ofdatasets to compensate for the aforementioned issues.

To address some the abovementioned issues Yalei ding et al. [8] presented a CNN model that was trained with the KDD’99 dataset. The findings of the proposed paper were compared with other studies that used KDDTrain+ as the training set, and KDDTest-21 and KDDTest+ as the testing sets. For the evaluation metrics such as accuracy, detection rate, and false positive rate were measured. ML algorithms such as Random Forest (RF), and Support Vector Machine (SVM), as well as DL algorithms such as Long Short-Term Memory (LSTM) and Deep Belief Network (DBN) were utilized. The results showcased that RF obtained the highest accuracy among the ML algorithms, scoring 74.18% at KDDTest+ and 51.01% at KDDTest-21. The second highest score among the DL algorithms was achieved by LSTM with 73.18% and 49.37%, respectively. The demonstrated results showcased that the authors’ proposed CNN model scored higher than all other ML and DL algorithms that were tested across all evaluation metrics, with KDDTest+ scoring 80.13% and KDDTest-21 scoring 62.32% in terms of accuracy.

More researchers every year are progressively beginning to utilize the ML and DL since they are constantly evolving and have great potential to detect cyberthreats on the network. Thus, Pramita Sree Muhuri et al. [9] presented a novel method to classify the NSL-KDD dataset with LSTM and Recurrent Neural Networks and compared their results with various traditional ML algorithms such as RF and SVM. Their approach intergrades a Genetic Algorithm (GA) for feature selection, which offers several benefits when the consideration of many features is required to predict a class. With 122 features that were selected from the multiclass NSL-KDD dataset the results showed that traditional ML algorithms such as SVM and RF achieved a 67.20% and 80.70% score in accuracy, respectively, while the proposed model achieved 82.68%. Moreover, the addition of 99 optimal features improved the aforementioned models, with SVM reaching 68.10% and RF achieving 84.90%, while the proposed model improved significantly reaching a 93.88% in accuracy. The results demonstrated that DL algorithms outperformed ML algorithms regarding the evaluation metrics.

With the steady evolution of ML and D to detect intrusions, the authors [10] developed a DL-based NIDS, which focuses primarily on Denial-of-Service attacks (DOS). During the training phase of the DL NIDS two different datasets were used, namely: KDD’99 and CSE-CIC-IDS 2018. Moreover, two (2) additional models were developed, one with CNN and one with RNN to cope with time series data or data that includes sequences. Results demonstrated that CNN achieved a 99% accuracy with KDD’99 multiclass dataset and 91.5% accuracy with CSE-CIC-IDS 2018 multiclass dataset. On the contrary, RNN model reached a score of 93% and 65% in accuracy, when using KDD’99 and CSE-CIC-IDS 2018, respectively.

In similar vein, the authors in [11] presented a hybrid DL model for network intrusion detection with Bidirectional LSTM and CNN that were trained on the NSL-KDD and UNSW-NB15 datasets. The proposed model reached a score of 98.88% on the scale of detection rate (DR), 0.43% in FPR, and 99.22% in accuracy when trained with the NSL-KDD multiclass dataset, while with the UNSW-NB15 multiclass dataset it reached 92.5% in DR, 6.0% at FPR, and 82.08% in accuracy. These results were compared with another research model, the HAST-IDS that was trained and evaluated with the same datasets. HAST-IDS reached 95.85% in DR and 93.27% in accuracy when trained with the NSL-KDD dataset. On the contrary, when trained with UNSW-NB15 the model achieved 93.65% in DR, 9.6% in FPR and 80% in accuracy, indicating that the proposed model when trained with NSL-KDD outperformed the rest of the implementations that were used for the comparison.

Following the approach in [11], Pengfei Sun K et al. in [12] developed a DL hybrid NIDS incorporating a CNN and an LSTM model. The proposed solution was trained with the CICIDS2017 dataset, and the authors applied one hot encoding to the data in order to be used for multi-class classification. For the evaluation of the proposed model, two additional models were developed with the same input data. The first model was based on CNN, while the second was based on LSTM. TheresultsshowedthattheCNNmodelreached98.44%inaccuracyand93.11% in F1-score while LSTM reached 96.83% and 90.97%. On the contrary, the proposed solution, which combines CNN and LSTM, achieved 98.67% and 93.32% accuracy in F1-score in the evaluation metrics and outperformed the models that were developed based solely on either CNN or LSTM.

CIC2017 was also used by the authors in [13], who provided a highly scalable and hybrid Deep Neural Network (DNN) framework trained with a variety of datasets, which was applied in real scenarios to efficiently monitor network traffic and host level events in orderto avoid possible intrusions. The topology architecture of this method had 5 layers of DNN, and the authors utilized 5 different datasets to train this hybrid DNN model, namely KDD’99, NSL-KDD, UNSW-NB15, WSN-DS, and CICIDS 2017. The proposed architecture consisted of a different input and output layer of neurons, since each dataset is multiclass and features different quantities of classes. The evaluation of the proposed framework after training showed that WSN-DS, CICIDS2017, KDD’99, NSL-KDD and UNSW-NB15 datasets achieved accuracy results of 96.4%, 95.6%, 92.5%, 78.5%, and 65.1%, respectively. According to their findings, their DNN framework outperformed various ML algorithms such as RF, SVM etc., utilizing the same multiclass datasets, in accuracy, precision, recall, and f1-score. In order to achieve real time detection of the intrusions and attacks, the authors deployed the proposed DL model into the realistic network and results showed that this hybrid and highly scalable proposed framework has the ability to constantly monitor network traffic and supply alerts whenever malicious traffic is detected in real time; however, the authors did not reveal the exact prediction rate of that traffic.

In similar vein, the authors in [14] presented a scalable and hybrid IDS. The proposed solution was developed with the Spark-ML and Convolutional-LSTM and trained with the ISCX-IDS 2012 dataset. The evaluation of the presented approach was compared with similar studies, using the same dataset. The authors’ scalable and hybrid systems showed an accuracy rate of 97.29% and a false alarm rate of 0.71%. Although, additional studies had satisfactory rate of 95.31% in accuracy and 0.80% in false alarm rate, authors with their approach provided better results with this particular dataset.

The performance of bidirectional and conventional LSTM models was investigated by Yakubu Imrana et al. [15], who presented a Bidirectional LSTM model consisting of two separate LSTM modules, trained on the original and reversed input datasets correspondingly. In order to validate the effectiveness ofthe bidirectional LSTM model, the results were compared with a conventional LSTM model while NSL-KDD dataset was used for the training of the model. The proposed model was validated with stratified K-fold to verify the training accuracy percentage for each class. After the evaluation, results revealed that bidirectional LSTM model outperformed the conventional LSTM in evaluation metrics such accuracy, precision, recall, FAR, and f1-score. The results of the conventional LSTM were 87.26% in accuracy, 90.34% in precision, 87.26% in recall, 4.03% in FAR, and an f1-score at 88.03%, while the author’s proposed model achieved 91.36%, 92,81% 91,36%, 0.88%, and 91,67%, respectively.

Moreover, the authors in [16], developed a NIDS with CNN that utilized the NSL-KDD dataset. The proposed model accomplished an accuracy of85.83% and a loss of 1.5553% without authors providing any further information regarding the training metrics of the model, such as Recall, Precision, and F1-Score metrics. To evaluate the performance of the model after the training the authors extracted network traffic with the Python Scrapy library, but they had significant deficiency of the statistical data essential to fit characteristics of the NSL-KDD dataset. To compensate for the problem ofessential characteristics they used a network analyser namely Tshark, which is the command line version ofWireshark. According to their findings, their proposed NIDS performed real time detection of the intrusions by monitoring the traffic ofspecific port; however, they did not supply further details regarding the model’s capabilities at real time detection.

Moving one step furher, Peilun Wu et al. [17] presented a hierarchical CNN combined with a RNN model trained with two common datasets, the NSL-KDD and the UNSW-NB15. The structure of the model was divided in three blocks; each block contained the proposed model, which was the combination ofRNN and CNN with different filters. Furthermore, during data pre-processing, features were converted into groups, conducting standardization ofthe data and stratified k-fold cross validation. The training’s phase results showcased that when trained with the NSL-KDD dataset the model achieved 99.02% in detection rate (DR), 99.14% in accuracy and 0.61% in false positive rate (FPR), while when trained with UNSW-NB15 it reached 97.43%, 85.35%, and 2.89%, respectively. The proposed combined model of CNN and RNN hierarchy outperformed various ML algorithms such as RF, AdaBoost, and SVM with Gaussian Kernel (RBF) to all metrics.

In an effort to detect network intrusions, the authors of the above presented studies utilized various datasets, algorithms and combinations between of them with intend to enhance their proposed modules. However, in those case of studies, they did not specify whether their proposed models were evaluated with real network traffic captured in near real-time or real time scenarios to detect intrusion on the network. Only the proposed solution in [13] was deployed in a realistic scenario aiming for near-real time evaluation, nonetheless, the authors did not provide detailed results in their study.

According to the literature review, very few papers realistically evaluated their proposed NIDS solutions. Furthermore, although the aforementioned research studies achieved high scores between 90% and 99%, one of their shortcomings is that they used outdated multi-class datasets that do not accurately represent modern network traffic. The few of those publications that used more recent datasets for the training of their models, they used datasets that represent only a small portion of modern network traffic, while, even though they accomplished their goals with high scores between 86% and 99% in evaluation metrics such as accuracy, recall, precision, and f1-score, they did not evaluate their solutions over a realistic network in real world conditions and did not assess the capabilities of their models to identify intrusion in near real-time. Therefore, most of the reviewed studies only approximated the model’s behavior after learning from the input datasets, while for the models to be fully evaluated as intrusion detection solutions they should be applied to real network scenarios.

Based on the gaps of the literature review, in this chapter an AI-based NIDS is designed and implemented that:

• is trained with an already in-house developed, recent, enhanced and modern NIDS dataset, containing not only network traffic but also logs and vulnerability assessment information about the system

• is evaluated following a realistic, near-real time evaluation process. During the evaluation phase, the NIDS is deployed in a realistic network topology and various cyber-attacks are performed, assessing near-real time performance.

This sub-chapter discusses the structure of the proposed NIDS, the DL model utilized, and the pre-processing methodology that was followed for developing the in-house dataset that was fed to the DL model.

Among the most common datasets utilized in recent studies for ML and DL models to detect intrusions are KDD’99 [18] and NSL-KDD [18] that are considered benchmark datasets for training ML-based NIDSs; however, the traffic included in these datasets is outdated. In addition, KDD’99 contains several duplicate records, which is among its limitations, while NSL-KDD has the disadvantage of class imbalance. Furthermore, more recent datasets have been released, such as the UNSW-NB15 [19] dataset that has been developed by the University of New South Wales (UNSW). This dataset includes network traffic that illustrate various scenarios and up to date attacks, resulting in a major upgrade compared to KDD’99 and NSL-KDD datasets. Nonetheless, the major limitation of this dataset is that the traffic was produced using a network traffic testbed and, even though the testbed was designed to mimic real-world network traffic, this simulation process led to producing a “Synthetic” network traffic dataset. Moreover, the University of New Brunswick (UNB) developed the CIC-IDS2017 [20] dataset, which is more recent than UNSW-NB15. This dataset was created in a controlled environment that mimics network traffic from the real world, both benign and malicious. In addition, the developers included interactions between different types of real users inthedataset,whichwascollectedoverthecourseoffivedaysinordertoimproveits robustness and the accuracy of anomaly detection for the ML models. The dataset’s major drawbacks are the fact that it is also a “Synthetic” network traffic dataset since it was developed in a controlled environment while it includes a significant data class imbalance between attack and normal traffic. Furthermore, the dataset’s lack of heterogeneity is an additional disadvantage.

In this proposed solution, a modern, up to date, enhanced, heterogeneous, inhouse developed dataset was selected for the training of the DL model of the proposed NIDS. The dataset was captured in 2022 and comprises 68 characteristics in total, 63 of which are network features and 5 are extra characteristics, such as vulnerability assessment information and logs that have been inserted to enhance the dataset. Additionally, an 80/20 split was used to divide the initial dataset, which contained approximately 16000 rows, into two different sets. 20% of the data constitutes the testing set and 80% the training set.

The network traffic flow of the dataset was captured by employing Wireshark and Tcpdump while the benign system was operated by real users who generated realisticnetworktrafficconsistingofinternetbrowsingandinteractionsamongvari-ous benign services. Moreover, malicious Python scripts and information stemming from the Common Vulnerability Enumeration (CVE) were utilized to generate the malicious network traffic that was captured as part of the dataset. The captured traffic data were converted into NetFlow v5 network flows by using CICFlowMeter. Eventually, the dataset contains six classes: one class represents benign traffic, and the other five classes represent malicious traffic and include cyber-attacks such as DDos Slowloris, SSH Brute Force, ICMP Ping Flood, TCP Fingerprinting, and Remote File Inclusion. The definition of the cyber-attacks that are contained in the dataset as well as the dataset labels are provided in Table 14.1 below.

The additional features that were inserted to the dataset, complementing its 63 network features, represent vulnerabilities of the physical machines. Each one ofAttackAttack descriptionRemote File

InclusionUnauthorized file uploading to obtain system administrative rights

SSH Brute Force is a technique used to gain access to a remote server or a machine via SSH by guessing the right credentialsSSH Brute ForcePing flood is a DDOS attacks that sends numerous ICMP requests resulting to reduced system performance.ICMP Ping FloodA high volume of HTTP requests that negatively impact a system’s performance and availability.DDos SlowlorisNetwork activity that examines a system to identify its operating system and/or active services of the targeted machine

those vulnerability features have a 1 or 0 value assigned to them regarding the presence ofthe respective vulnerability on the system. Table 14.2 below showcases the network features contained in the dataset and the importance factor rate.

The training set of the dataset was inserted as input to the proposed CNN model, which was designed to be employed for multi-class classification. The model was trained over an epoch of80, and the Adam optimizer, which has a low learning rate, was used to stabilize the model throughout training. The model utilizes a variety of regulations to prevent overfitting such as dropout layers, and early stopping. It additionally makes use of a model checkpoint to save the best-performing model during the training ofthe model. For the NIDS to be operational after training, it needs to be deployed in the network interface. To distinguish the incoming traffic between benign and malicious traffic, the traffic needs to be passed through the NIDS to predict whether it is malicious or benign.

The model input shape layer depends on the number offeatures included in the in-house developed dataset, which in the proposed solution were 68. The model is composed of two convolutional blocks namely two conv2D with the Rectified Linear Unit (Relu) activation function in each block, which is one of the most frequently utilized activation functions for DL Neural Networks since it doesn’t activate the neurons simultaneously. Furthermore, each block has Batch Normalization, MaxPooling2D and Dropout layer. Batch Normalization is a method that helps the model to train faster and provides more stability to the model. The MaxPooling2D technique was employed for feature extraction and down sampling to ensure robustness ofthe model. Furthermore, the Dropout layer is a regulation form that was utilized to drop random neurons during training. The fully connected layer consists ofa flatten layer that converts 3D tensors stemming from the second convolutional block into 1D vector. Furthermore, the fully connected Dense layer has 64 neurons, which is typically the most suitable choice of neurons for having the necessary capacity to learn from the data. Less neurons would not comprehend the complexity of the data, while more would lead to overfitting while featuring the Relu activation function and the Dropout Layer regulation form. Considering that the dataset is multi-class, the output layer has a Dense layer with a number ofneurons equal to the number ofclasses ofthe dataset, i.e., six. SoftMax was the activation function used for the output layer since it categorizes the output prediction distribution over the classes and is suitable for multi-class classification. In Figure 14.1 below the model architecture is showcased.

Furthermore, Figure 14.2 below delves deep into the inner architecture of the proposed DL model and provides a visualization ofthe neural network which consists of an input layer, two convolutional blocks, a fully connected layer, and an output layer. The input layer contains 68 neurons, following the number of features included in the datasets. Following, each convolutional block has 2 conv2D layers with 16 neurons. In addition, the convolutional blocks include 3 more layers named Batch Normalization, MaxPooling2D, and Dropout. The fully connected layer consists of a flattened layer that converts the 3D vectors into 1D vectors, a dense layer that includes 64 neurons, and a dropout layer. Furthermore, the output layer length, i.e., the number of neurons that comprise it, depends on the classes that a dataset includes; in this case, the in-house dataset has six (6) classes.

The model operates in the following order: The input layer neurons provide inputs to the first convolutional block, which are the features derived from the dataset. The first convolutional block transforms the input data into a feature map set. This feature set is the reduced patterns, such as edges, textures, and shapes, of the input data after the implementation of the convolutional filter (kernels), while preserving the essential components of the input data. The feature map set produced by the first convolutional block is inserted into the second convolutional block, which performs the same processes as the first one and develops the final feature map set to be inserted into the fully connected layer. Following, the flattening layer of the fully connected layer converts the final feature map into onedimensional vectors. Moreover, the fullyconnected layer operates as a classifier since it connects every neuron after the conversion of the flattening layer with the neurons of the output layer to produce the predictions.

The configuration of links and nodes in a network, either physical or virtual, are referred to as the network’s topology. Typically, artificial nodes consist of devices such as switches, routers, and SDN (software with network configuration functions). In an attempt to avoid interfering with the real network adapter, a virtual adapter created though VirtualBox (VM) was utilized in the proposed implementation to construct an isolated environment into which the NIDS solution was deployed. The network topology was based on a two-fold approach, i.e., a benign system that utilizes resources of network without interfering with the network, which would result in network failures or insufficient performance of the network, and a malicious system that causes network interference. The NIDS is an extra security layer on the network, which is usually placed between benign systems and switches because it is a pivotal spot to ensure the optimal ability to detect intrusions and respond to those threats, since at this position the NIDS can monitor the communication between the external incoming traffic and the internal hosts of the network. Figure 14.3 below illustrates the communication between the malicious and benign systems as well as where the proposed NIDS is placed in this topology.

Furthermore, Figure 14.4 below shows the functionality of the proposed NIDS. The first step of the process was to train the proposed DL model with the dataset and extract the model with h5 and Json format. Through the first process, the proposed NIDS establishes a baseline for both benign and malicious network behaviour. The second process is the deployment of the NIDS at the already configured isolated environment to make predictions regarding incoming network traffic.Since the dataset includes a classification of multiple classes, the third step includes the NIDS generating predictions about the network traffic that passes through and sorting the traffic using a format of tabulate.

In this section, the performance of the proposed NIDS using the CNN algorithm is analyzed. The goal is to evaluate the proposed NIDS as an intrusion detection solution when deployed on a realistic network interface and assess its capacity to detect intrusions in near-real time as well as compare the performance results when the proposed solution is trained with the in-house developed dataset and a commonly used dataset stemming from the literature. The approach and results of the evaluation procedure are presented and discussed below.

Two datasets were used for the evaluation procedure, namely the already in-house developed dataset described in the Implementation sub-chapter and the CIC-IDS2017 dataset, which is one of the most popular datasets for intrusion detection research, including up-to-date benign and malicious attacks representing real network traffic data. The CIC-IDS2017 dataset contains 8 attack types including Brute Force Attacks, Denial of Service (DoS) Attacks, Heartbleed Attack, Botnet Attack, Web Attacks, Infiltration, Port Scan, and Distributed Denial of Service (DDoS). The common denominator between the implemented datasets is in total 3 types of attacks, including a variate of DOS attack named SlowLoris, SSH Brute Force attack, and ICMP PingFlood. The proposed NIDS, i.e., the CNN model included, was trained using each dataset for multi-class classification, at the beginning of the evaluation.

The evaluation of the proposed solution included two experiments. The first experiment referring to the evaluation of the training and validation phases of the CNN model, which included the training and validation of the proposed NIDS including the collection of the results after the training and test phase and the evaluation of them using ML metrics that are described as dependent variables. Two versions of the proposed NIDS resulted from this first experiment, namely version A, trained with the already in-house developed dataset, and version B, trained with the CIC-IDS2017 dataset. The second experiment was the testing of version A and version B of the NIDS in near real-time. After the two versions of the proposed NIDS were trained, the CNN model of both versions was exported in h5 and Json format. In order to evaluate near real-time intrusion detection of the proposed solution, real network traffic was captured via CICFlowMeter and was modified to CSV so that it could be inserted in near-real time into the two versions of the trained NIDS and determine if the captured traffic was benign or malicious.

These values remain constant during an experiment. The fixed variables in these experiments were the DL methods, network topology, malicious and benign systems, system vulnerabilities and cyber-attacks.

These variables depend on the model itself or the defined problem (in this chapter referring to network intrusion detection). In the proposed approach the independent variables are the dataset’s features and values, as well as the model’s architecture and parameters. Altering the independent variables forces different outcomes on the dependent variables.

Dependent variables are those that change based on the independent ones. The dependent variables of this experiment include the ML metrics that were used for the evaluation of the model, namely accuracy and loss of both training and validation phases as well as accuracy, precision, recall, and f1-score assessing the performance of the trained model.

The two versions of the proposed NIDS were tested on an Oracle VM VirtualBox that was developed specifically for the experiments in order to evaluate the CNN model during training and validation phase and achieve near-real time intrusion detection. To prevent interference with the physical network adapter, a Host-only bridge adapter was utilized at VirtualBox. This virtual adapter-maintained communication between the malicious and benign systems. The first experiment set up for both systems had a 30-gigabyte disk space and 4 processors with a 100% performance limit, with the exception that the benign system had 16 GB ram with 2400 MHz and the malicious system had 4 GB ram. The operating system used for both the attacker and the victim was Kali Linux, version 2022,3. The benign system had the following characteristics: pre-installed, enabled firewall, Apache server deployed on TCP port 80, and SSH server established via port 22. The second experiment was the deployment of the two NIDS versions to achieve near-real time intrusion detection. For both NIDS versions, CICFlowMeter was utilized for capturing live network traffic. The captured traffic was then fed into the NIDS in order to achieve predictions in near real time. The malicious system used the Metasploit framework to generate malicious attacks as those that are in common between the in-house developed dataset and the CIC2017 dataset, enabling the NIDS to predict the traffic captured via CICFlowMeter in near real time.

The training and validation performance results of the two versions of the proposed NIDS, i.e., version A trained with the already in-house developed multiclass dataset and version B trained with the multi-class CIC-IDS2017 dataset, are anticipated to be strongly promising since both of these datasets represent modern network traffic. Moreover, experiment results are foreseen to be over 95% at the evaluation of the training and validation phase of the proposed CNN DL model for both NIDS versions. In the second experiment, the proposed NIDS is evaluated in near real-time and positive results are expected, similar to the first experiment. It is also anticipated that version A NIDS will outperform version B NIDS due to the enhanced and heterogeneous data included in in the already in-house developed dataset.

In this section the results of the first experiment of the proposed NIDS,both version A and version B, are presented. The epochs for the proposed NIDS for version A and version B were appointed to be 80. Moreover, the CICIDS2017 dataset includes nine (9) attack types, which means that it has nine classes, while the inhouse developed dataset has six (6). The two datasets contain 3 common malicious attack types, namely SSH brute force attack, Dos slowloris, and ICMP ping flood indicating that the two versions of the proposed NIDS have 3 common output layers.

The training loss for version B NIDS was 0.0863% and the validation loss was 0.0740%, while version A NIDS showcased a training loss of 0.056% and a validation loss of 0.064%. In addition, version B NIDS achieved training accuracy of 97.45% and validation accuracy of 97.85%, while version A NIDS accomplished 97.80% and 97.95%, respectively. The proposed NIDS showcased great efficiency in predicting the network traffic with each aforementioned dataset as it can be noted by the high accuracy results while both training and validation loss values were minimal. Table 14.3 below illustrates the validation and training results of both versions of the proposed NIDS.

In Figure 14.5 below the training and validation loss of the proposed model are plotted; The left figure represents the training of version A NIDS and the right figure the training of version B NIDS. As explained above, the default epoch for the training of the models was 80, however, the model utilized a regulation form named Early Stopping to prevent overfitting. The CNN model on the left figure performed 53 epochs while the CNN model on the right performed 55. In Figure 14.1, the red line represents the validation loss and the green line the training loss. Moreover, the validation loss line is parallel to the training loss line for both version A and B of the NIDS, implying that there is neither under-fitting nor overfitting during the training of the proposed model.

Moreover, in Figure 14.6 below the left and right diagrams showcase a comparison between the training and validation accuracy for version A and version B NIDS, respectively, during the training of the models. The red line represents the validation accuracy and the green line the training accuracy, which are parallel during the training phase for both version A and B.

Moreover, during the training phase of both versions of the proposed NIDS, additional metrics such as accuracy, precision, recall and f1-score were collected. Version B NIDS showcased an f1-score of 97.61%, precision of 97.81%, recall of 97.83%, and accuracy of 97.41%, while version A NIDS reached 97.68%, 97.90%, 97.62%, and 97.72%, respectively. This indicates the proposed models function well since the training accuracy is high. Since the training accuracy is high, the model trains efficiently on the input datasets, while the validation accuracy represents the objective assessment of the model’s capacity to generalize the inconspicuous data. In addition, the model’s prediction accuracy indicates the capacity of the model to predict with effectiveness. The results of the proposed NIDS during the first experiment were obtained from the Scikit-learn¹ ML Python library. The average score results after training of versions A and B of the proposed NIDS are presented and illustrated in Table 14.4 and Figure 14.7 below.

Network data were captured in near real time from the virtual network interface using CICFlowMeter when the malicious activities were conducted and then they were fed into the two versions of the trained proposed model. This technique led the proposed model to generate predictions in near-real time. The results showcased that version B NIDS had less than 40% of prediction accuracy in near-real time traffic when the proposed model was trained with the CIC2017 dataset and was deployed in the virtual network, despite the fact that the model’s dependent variables showed great performance during the training phase. On the contrary, version A NIDS predicted accurately over 90% of the in near real time traffic, outperforming version B NIDS. The training and detection in near real time results for both NIDS versions are presented in Table 14.5 and Figure 14.8 below.

After using the CNN algorithm to train the proposed DL model, the datasets results demonstrated that version A NIDS, using the in-house developed dataset, performed better than when the CIC2017 dataset was used to train the model in version B NIDS, with regard to the ML metrics presented in the dependent variables. Version A NIDS achieved more than 97% accuracy in the training phase and while those results were only slightly better than the results of version B NIDS, there were significant differences between the two versions of the NIDS when they were both deployed on the network to evaluate them for the intrusion detection in near-real time. The results indicate that when the network data were captured live from the network and fed into the trained models, version A NIDS outperformed version B NIDS in near-real time intrusion detection. This resulted because the version A NIDS utilizes an in-house dataset for the training of the CNN model, which is enhanced, heterogeneous and contains up to date modern network activity.

Most studies in recent literature use KDD’99 and NSL-KDD as input to train and test their ML or DL model that is part of their NIDS solution. However, these datasets are outdated, they do not represent realistic network traffic, nor they deploy their models on a realistic network to evaluate them. In order to compensate for the aforementioned issues, the NIDS solution proposed in this chapter was developed to detect intrusion in near-real-time and utilized an in-house developed, multiclass, enhanced dataset that includes modern benign and malicious network traffic. Moreover, the proposed NIDS was evaluated in a realistic scenario, during which it was assessed when trained with the in-house developed dataset and when it was trained with the CIC-IDS2017 dataset, which is a benchmark modern network traffic dataset. The proposed NIDS achieved the detection of the intrusion in near real-time, and as results demonstrate, the proposed model accomplished above 90% prediction accuracy in near real-time traffic when the model was deployed in a realistic network environment and trained with the in-housed dataset. Conversely, the CIC-IDS2017 showed remarkable performance during the training phase. However, during the deployment of the model in the network, the prediction rate was less than 40% when evaluating realistic network traffic in near real time. The NIDS proposed in this chapter performed more effectively in near-real-time traffic detection when trained with the in-house developed dataset compared to when trained with the CIC-IDS2017 dataset.

The evaluation experiment performed in this chapter raised several concerns about DL methods, the development of model’s necessities, and the initial processing of input data that DL needs to obtain the most efficient outcomes. Although the proposed model achieved the objective to detect intrusions in near-real time more accurately with the in-house dataset, it is possible further enhancement can be made by introducing more network traffic to the dataset.

Therefore, in order to obtain more efficient results in near real-time detection, future research could utilize a variety of preprocessing techniques to enhance the input dataset. In addition, further hyper-tuning of the parameters of the model could be investigated in order to decrease the training time. Furthermore, evaluating the system by using a wide range of AI algorithms could provide additional insight into the capabilities of the proposed solution, since the proposed implementation solely explored the capabilities of the CNN algorithm.

This research initiative is supported by the European Union’s Horizon Framework Programme for Research and Innovation, under the projects: INTACT (Grant Agreement No. 101168438), cPAID (Grant Agreement No. 101168407), and CoGNETs (Grant Agreement No. 101135930).