BedIDS: An Effective Network Anomaly Detection Method by Fusing Behavior Evolution characteristics

Leveraging artificial intelligence models to enhance the performance of intrusion detection systems has become an important component in the field. However, as the scale of networks continues to expand, the structure of networks becomes more complex, and the amount of data in the networks grows larger. Existing methods are facing numerous challenges, including difficulties in constructing training datasets for models, challenges in transferring and reusing models, and high costs associated with model training. This paper introduces a novel approach named BedIDS. This method involves constructing the evolutionary process of network behavior and calculating the evolutionary characteristics of network behavior. Using only the most fundamental five network traffic features, including IP addresses, BedIDS achieves rapid and accurate detection performance on a device equipped with a 3060ti graphics card. We conducted tests using the CICIDS2017 and UNSW-NB15 datasets to evaluate its performance. Experimental results demonstrate that BedIDS maintains high detection accuracy and improves detection speed while requiring a relatively low AI computing force.