Network Intrusion Detection System with Anomaly-based Detection

Overview

A hybrid deep learning approach for zero-day attacks, network intrusion detection using autoencoders and LSTM with attention mechanism. The system combines unsupervised and supervised learning techniques to detect network intrusions.

Features

• Hybrid architecture (Autoencoder + LSTM + Attention mechanism)
• Anomaly detection through reconstruction error analysis
• High performance metrics (F1-Score: 0.96, AUC-ROC: 0.98)
• Comparative analysis with baseline models

Requirements

• Python 3.8+
• TensorFlow 2.x
• Scikit-learn
• Pandas
• NumPy
• Matplotlib
• Seaborn

CICIDS 2017 Dataset

The CICIDS 2017 dataset is used in this project. Instead of uploading the dataset to GitHub due to file size constraints, you can download the dataset directly from Kaggle:

CICIDS 2017 Full Dataset

Model Architecture

• Autoencoder for dimensionality reduction

• LSTM with attention for sequential pattern analysis

• Reconstruction error analysis for anomaly detection

  

Performance

• F1-Score: 0.96

• AUC-ROC: 0.98

• Comparative analysis with RF and XGBoost baseline models

  

Author

Tharanesh A