A Combination of Temporal Sequence Learning and Data Description for
  Anomaly-based NIDS
  Through continuous observation and modeling of normal behavior in networks,
Anomaly-based Network Intrusion Detection System (A-NIDS) offers a way to find
possible threats via deviation from the normal model. The analysis of network
traffic based on the time series model has the advantage of exploiting the
relationship between packages within network traffic and observing trends of
behaviors over a period of time. It will generate new sequences with good
features that support anomaly detection in network traffic and provide the
ability to detect new attacks. Besides, an anomaly detection technique, which
focuses on the normal data and aims to build a description of it, will be an
effective technique for anomaly detection in imbalanced data. In this paper, we
propose a combination model of Long Short Term Memory (LSTM) architecture for
processing time series and a data description Support Vector Data Description
(SVDD) for anomaly detection in A-NIDS to obtain the advantages of them. This
model helps parameters in LSTM and SVDD are jointly trained with the joint
optimization method. Our experimental results with KDD99 dataset show that the
proposed combined model obtains high performance in intrusion detection,
especially DoS and Probe attacks with 98.0% and 99.8%, respectively.
