Network Intrusion Detection System Using Anomaly Detection Techniques

In the current digital landscape, protecting networks against malicious activities is a critical challenge. Network Intrusion Detection Systems (NIDS) are vital as the first line of defense, continuously monitoring network traffic to detect and prevent potential attacks in real-time. As cyber-attacks get more complex and more similar to normal traffic, robust NIDS solutions have become more crucial than ever. This paper proposes an architecture for an anomaly-based NIDS that has a Multi-Layer Perceptron (MLP) as a binary classifier. The system employs the Cisco TRex generator to simulate network traffic, capturing and analyzing the data using tcpdump and Zeek, and lastly preprocessing it for the MLP using Python scripts. Three algorithms were evaluated for the classification task: Isolation Forest (IF), MLP, and Autoencoder, all implemented with TensorFlow and Keras. The models were trained and tested on two widely recognized datasets for anomaly detection, KDDCUP99 and UNSW-NB15. The experimental results show the superiority of the UNSW-NB15 dataset compared to the KDDCUP99 one in terms of complexity and its likeness to real-world traffic. Moreover, the results also prove that a simple Deep Learning (DL) algorithm such as the MLP can serve as an effective first-line defense against cyber threats. This study contributes to the ongoing development of more effective NIDS by exploring the application of machine learning techniques in anomaly detection, offering the potential for enhancing network security.