Experimental Review of Neural-based approaches for Network Intrusion
  Management
  The use of Machine Learning (ML) techniques in Intrusion Detection Systems
(IDS) has taken a prominent role in the network security management field, due
to the substantial number of sophisticated attacks that often pass undetected
through classic IDSs. These are typically aimed at recognising attacks based on
a specific signature, or at detecting anomalous events. However, deterministic,
rule-based methods often fail to differentiate particular (rarer) network
conditions (as in peak traffic during specific network situations) from actual
cyber attacks. In this paper we provide an experimental-based review of
neural-based methods applied to intrusion detection issues. Specifically, we i)
offer a complete view of the most prominent neural-based techniques relevant to
intrusion detection, including deep-based approaches or weightless neural
networks, which feature surprising outcomes; ii) evaluate novel datasets
(updated w.r.t. the obsolete KDD99 set) through a designed-from-scratch
Python-based routine; iii) perform experimental analyses including time
complexity and performance (accuracy and F-measure), considering both
single-class and multi-class problems, and identifying trade-offs between
resource consumption and performance. Our evaluation quantifies the value of
neural networks, particularly when state-of-the-art datasets are used to train
the models. This leads to interesting guidelines for security managers and
computer network practitioners who are looking at the incorporation of
neural-based ML into IDS.
