A novel hybrid ensemble deep learning approach for cyber intrusion detection

The uninterrupted growth of transactions carried out over the Internet (e.g., adoption of digital payments) can lead to potential exposure to serious security problems. Regarding the implementation of innovative technological solutions, the scientific community strives to develop approaches which can effectively protect the entities from adversarial cyber-threats. This research focuses on improving network security, developing the Hybrid Ensemble Deep Learning Intrusion Detection System ( <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML" display="inline" overflow="scroll"> <mml:msup> <mml:mrow> <mml:mi mathvariant="normal">HEDL</mml:mi> </mml:mrow> <mml:mrow> <mml:mi mathvariant="normal">∞</mml:mi> </mml:mrow> </mml:msup> </mml:math> ). It is the optimized version of the previous two older releases, namely HEDL-IDS and <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML" display="inline" overflow="scroll"> <mml:msup> <mml:mrow> <mml:mi mathvariant="normal">HEDL</mml:mi> <mml:mtext>-</mml:mtext> <mml:mi mathvariant="normal">IDS</mml:mi> </mml:mrow> <mml:mn>2</mml:mn> </mml:msup> </mml:math> . The Ensemble consists of two Deep Neural Networks (DNN), four Convolutional Neural Networks (CNN) and five Recurrent Neural Networks (RNN) with parallel LSTM layers. The classifier of each Ensemble employs an improved Custom Vote process, following the Weighted Vote and the Majority Vote principles. The <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML" display="inline" overflow="scroll"> <mml:msup> <mml:mrow> <mml:mi mathvariant="normal">HEDL</mml:mi> </mml:mrow> <mml:mrow> <mml:mi mathvariant="normal">∞</mml:mi> </mml:mrow> </mml:msup> </mml:math> was successfully validated on the UNSW-NB15 dataset, with overall accuracy equal to 99.56% during the training phase and 99.24% during the testing phase. The high values of the performance indices during testing confirm that the updated version is a robust tool that can be used in real-world, to significantly reduce the exposure of the network’s users, paving the way for further research efforts.