Abstract

Intrusion Detection System (IDS) has become one of the keys to keeping the existing network infrastructures secure against more developed cyber threats. Nevertheless, the difficulty to properly identify different types of attacks in mass network traffic is associated with the large dimensional feature space and the large class imbalance of cybersecurity data. To address these issues, this study proposes a hybrid intrusion detection model, which combines deep feature learning and ensemble classification. Specifically, a Multilayer Perceptron (MLP) built with TensorFlow Keras is used to automatically acquire high level representations on network traffic data using fully connected layers with batch normalization and dropout regularization. These deep features are then combined with the original normalized features to compose an enriched feature set that is used to train an Extreme Gradient Boosting (XGBoost) classifier to give the final classification of attacks. The proposed model is evaluated on the CIC-UNSW-NB15 augmented dataset, consisting of ten classes of normal and malicious traffic. Accuracy and F1-score provided by the experimental results are 92.32% and 0.927 with weights that show strong performance under imbalanced classes.