A multimodal hybrid parallel network intrusion detection model

Figures & data

Table 1. Table of acronyms.

Acronym	Full name
IDS	Intrusion Detection System
ML	Machine Learning
DL	Deep Learning
CNN	Convolutional Neural Network
RNN	Recurrent Neural Network
LSTM	Long Short-Term Memory
FCN	Fully Convolutional Network
CV	Computer Vision
IIoT	Industrial Internet of Things
KMP	Knuth-Morris-Pratt Algorithm
BM	Boyer-Moore Algorithm
BMH	Boyer-Moore-Horspool Algorithm
BMHS	Boyer-Moore-Horspool-Sunday Algorithm
DT	Decision Tree
SVM	Support Vector Machine
MHPN	Multimodal Hybrid Parallel Network Intrusion Detection Model
PCCN	Parallel Cross-fused Convolutional Neural Network

Table 2. Related work.

Author	Method	Pattern matching	ML	DL	Multimodal	Year
Wu and Shen	AC-BM	Yes				2012
Hnaif et al.	PDMA	Yes				2021
Anthi et al.	A Supervised Intrusion Detection System for Smart Home IoT Devices		Yes			2019
Jan et al.	SVM		Yes			2019
J. Li et al.	AI-Based Two-Stage Intrusion Detection for Software Defined IoT Networks		Yes			2019
Dong et al.	Real-Time Network Intrusion Detection System Based on Deep Learning			Yes		2019
Bontemps et al.	Collective Anomaly Detection Based on Long Short-Term Memory Recurrent Neural Networks			Yes		2016
Y. Zhang et al.	PCCN			Yes		2019
X. Wang et al.	App-Net				Yes	2020
Aceto et al.	MIMETIC				Yes	2019
Aceto et al.	DISTILLER				Yes	2021

Figure 1. Network structure diagram.

Table 3. Experiment environment.

Equipment	Example
CPU	Intel(R) Xeon(R) Silver 4116 CPU@2.10GHz
GPU	Quadro P4000
RAM	64GB
OS	Ubuntu 16.04
Python	3.8.3
Database	ISCXIDS 2012, CICIDS2017

Table 4. The distribution of CIC-IDS2017.

Tag	Traffic type	Number	Percentage
0	Botnet	412	0.18%
1	DDoS	50157	22.27%
2	GlodenEye	4009	1.78%
3	Dos Hulk	89293	39.65%
4	Dos Slowhttp	1357	0.60%
5	Dos Slowloris	2102	0.93%
6	Ftp Patator	3987	1.77%
7	Heartbleed	1972	0.88%
8	Infiltration	1067	0.47%
9	Port Scan	63482	28.19%
10	SSH Patator	5509	2.45%
11	Web Attack	1873	0.83%

Table 5. The distribution of ISCX 2012.

Day	Traffic type	Flow Number	Percentage
Friday	Normal	378,667	40.9%
Saturday	Infiltration	109,140	11.8%
Sunday	Infiltration	14,728	1.6%
Monday	HTTP_DDoS	41,041	4.4%
Tuesday	DDos	53,603	5.8%
Wednesday	Normal	322,263	34.8%
Thursday	Brute Force SSH	6425	0.6%

Figure 2. Comparison of CICIDS2017 experimental results.

Table 6. Precision comparison table.

	0	1	2	3	4	5	6	7	8	9	10	11
CNN-T	1	1	0.9879	0.9926	0.9851	0.9877	1	1	1	0.9999	0.9947	0.982
CNN	0.9952	1	0.986	0.9977	0.983	0.9914	1	1	0.9991	0.9999	0.9996	0.9967
LSTM	0.9915	0.9998	0.9628	0.9902	0.9088	0.9492	0.9985	0.9995	0.9432	1	0.9913	0.9723
CNN-LSTM	0.9952	1	0.9774	0.9945	0.9763	0.9886	0.9995	1	1	0.9999	0.9996	0.9971
PCCN	1	1	0.9929	0.9994	0.9896	0.9929	1	1	1	1	0.9998	0.9986
MHPN	1	1	0.9983	1	0.9911	0.9962	1	1	1	0.9999	1	0.9979

Table 7. Recall comparison table.

	0	1	2	3	4	5	6	7	8	9	10	11
CNN-T	1	1	0.9985	1	0.9749	0.99	0.999	1	1	0.9955	0.9938	0.9626
CNN	0.9976	1	0.946	0.9995	0.9794	0.9881	0.999	0.9995	1	0.9999	0.9996	0.9976
LSTM	0.8447	0.9999	0.781	0.9993	0.8814	0.96	0.998	0.999	0.9963	0.9989	0.9936	0.9754
CNN-LSTM	1	1	0.872	0.9993	0.9698	0.9877	0.9987	1	1	0.9999	0.9993	0.9934
PCCN	1	1	0.9869	0.9997	0.9838	0.9938	0.9997	1	1	1	0.9998	0.9995
MHPN	1	1	0.999	1	0.9897	0.9952	1	1	1	1	0.9998	0.9984

Table 8. F1-score comparison table.

	0	1	2	3	4	5	6	7	8	9	10	11
CNN-T	1	1	0.9932	0.9963	0.98	0.9888	0.9995	1	1	0.9977	0.9943	0.9722
CNN	0.9964	1	0.9656	0.9986	0.9812	0.9898	0.9995	0.9997	0.9995	0.9999	0.9996	0.9972
LSTM	0.9122	0.9999	0.8624	0.9947	0.8949	0.9546	0.9982	0.9992	0.969	0.9994	0.9925	0.9739
CNN-LSTM	0.9976	1	0.9217	0.9969	0.973	0.9881	0.9991	1	1	0.9999	0.9995	0.9952
PCCN	1	1	0.9899	0.9996	0.9867	0.9934	0.9999	1	1	1	0.9998	0.9991
MHPN	1	1	0.9986	1	0.9904	0.9957	1	1	1	1	0.9999	0.9981

Table 9. FAR comparison table.

	0	1	2	3	4	5	6	7	8	9	10	11
CNN-T	0	0	0.0013	0.0013	0.0005	0.0006	0	0	0	0	0.0008	0.0008
CNN	0	0	0.0002	0.0016	0.0001	0.0001	0	0	0	0	0	0
LSTM	0	0	0.0005	0.0065	0.0005	0.0005	0	0	0.0003	0	0.0002	0.0002
CNN-LSTM	0	0	0.0004	0.0038	0.0001	0.0001	0	0	0	0	0	0
PCCN	0	0	0.0001	0.0004	0.0001	0.0001	0	0	0	0	0	0
MHPN	0	0	0	0	0.0001	0	0	0	0	0	0	0

Figure 3. Confusion matrix of CIC-IDS2017.

Figure 4. Comparison of ISCX2012 experimental results.

Figure 5. ISCX2012 dataset results. (a) Precision. (b) Recall. (c) F1-score. (d) FAR.

Figure 6. Comparison of multimodal experimental results.

Figure 7. Comparison of multimodal experimental results. (a) Precision. (b) Recall. (c) F1-score. (d) FAR.

Table 10. Comparison of employing the FCN and wiithout FCN.

	0	1	2	3	4	5	6	7	8	9	10	11
CNN_LSTM	1	1	0.872	0.9993	0.9698	0.9877	0.9987	1	1	0.9999	0.9993	0.9934
CMHPN	1	1	0.9852	0.9954	0.9831	0.9934	0.9995	1	1	0.9999	0.9998	0.9973
MHPN	1	1	0.999	1	0.9897	0.9952	1	1	1	1	0.9998	0.9984

Table 11. Test time of models.

Model	Test Time(s)	Model	Test Time(s)
CNN	4.32	KNN	31245
LSTM	4.89	CNN_LSTM	5.23
PCCN	6.78	MHPN	6.33