Adaptive Dictionary Optimization for LSTM-Based Detection of Low-Rate FTP Attacks with Noisy Training Sets

Network Intrusion Detection Systems (NIDS) face challenges from low-rate attacks that evade traditional methods, but deep learning models like Long Short-Term Memory (LSTM) networks offer a solution by analyzing network payloads directly. Fixed n-gram dictionaries, however, can lead to overfitting and reduced adaptability. This paper introduces a dynamic dictionary-sizing approach that adjusts to traffic statistics, improving flexibility and robustness when trained on noisy datasets containing both benign and malicious traffic. Experiments demonstrate that the proposed method achieves an average F2 score of 0.89 for FTP traffic—a 10% improvement over prior work—while maintaining resilience to noise. However, prediction results showed significant variation when applying mean-based thresholds during detection.