Rabih Rahimullah, Vahdat-Nejad Hamed, Mansoor Wathiq, Joloudari Javad Hassannataj
Faculty of Electrical and Computer Engineering, University of Birjand, Birjand, Iran.
College of Engineering and Information Technology, University of Dubai, Dubai, United Arab Emirates.
Sci Rep. 2025 Jul 1;15(1):21147. doi: 10.1038/s41598-025-08175-z.
Intrusion detection systems (IDS) are critical for safeguarding computer networks by identifying malicious activities. However, distinguishing attacks in IDSs with high accuracy is challenging. This research proposes a novel approach to enhance the accuracy of anomaly-based intrusion detection systems (IDS). This approach involves combining the Local outlier factor (LOF) algorithm for outlier detection and the Convolutional neural network (CNN) for classification. Firstly, the LOF algorithm is employed to evaluate the local density of network traffic instances, facilitating the identification of outliers deviating significantly from their neighboring data points. Subsequently, a CNN model is utilized for the classification of network traffic instances, effectively categorizing normal and abnormal behavior. CNN's strength lies in its ability to automatically extract relevant features from network traffic data through convolutional layers, thereby enhancing classification performance. The proposed approach achieves 99.87% accuracy in detecting and classifying anomalies in the public dataset of CSE-CIC-IDS2018. This remarkable result underscores the effectiveness of the combined LOF and CNN approach in accurately identifying malicious activities while minimizing false positives. The proposed approach offers valuable insights for researchers and practitioners in the field of network security, empowering them to develop more robust and effective intrusion detection systems.
入侵检测系统(IDS)对于通过识别恶意活动来保护计算机网络至关重要。然而,在IDS中高精度地区分攻击具有挑战性。本研究提出了一种新颖的方法来提高基于异常的入侵检测系统(IDS)的准确性。该方法涉及将用于异常检测的局部离群因子(LOF)算法和用于分类的卷积神经网络(CNN)相结合。首先,使用LOF算法评估网络流量实例的局部密度,便于识别明显偏离其相邻数据点的离群值。随后,利用CNN模型对网络流量实例进行分类,有效地将正常行为和异常行为进行归类。CNN的优势在于其能够通过卷积层自动从网络流量数据中提取相关特征,从而提高分类性能。所提出的方法在检测和分类CSE-CIC-IDS2018公共数据集中的异常情况时达到了99.87%的准确率。这一显著结果凸显了LOF和CNN相结合的方法在准确识别恶意活动同时将误报率降至最低方面的有效性。所提出的方法为网络安全领域的研究人员和从业者提供了有价值的见解,使他们能够开发出更强大、更有效的入侵检测系统。