Abstract

While cloud networks allow dynamic computing, storage, virtualization, and distributed services, their open and heterogeneous nature makes their network resources vulnerable to increasingly different intrusion activities. Traditional IDS usually employ either fixed signatures or single classifier, limiting their capability to detect new attacks and differentiate similar attack types. Machine Learning and Deep Learning methods have thus become key tools in automated IDS for cloud security. Recent researches have shown that cloud IDS researches still encounter some challenges related to false positives, redundant features, complexity, class imbalance, and inability to recognize multiple attack types. Current machine-learning based IDS are typically designed to do either binary attack recognition or direct multi-class attack classification. Binary models have little use of identifying attack types, while direct multi-class models can encounter high dimensional features, class imbalance, and misclassification due to similar attacks’ nature. A comprehensive approach is needed in order to detect suspicious traffic step by step and classify their attack type. In this paper, we introduce a new method named Multi-Stage Attention-Informed Cascade Intrusion Detection System (MSAIC-IDS). This framework includes correlation-based feature selection, attention-driven representation learning, hierarchical anomaly detection, and attack type classification. In the first stage, the system divides normal traffic and suspicious traffic, in the second stage, the major attack family is recognized, and finally, attack type classification is performed. Moreover, adaptive class weighting and confidence-driven cascading mechanism have been added to improve the performance of minority class classification and avoid unnecessary classifications. According to the experimental results on the CSE-CIC-IDS2018 data set, MSAIC-IDS has 99.31% accuracy, 99.18% precision, 98.96% recall, and 99.07% F1-Score with 0.69% false positive rate after 30 training epochs. Compared to the CNN-RNN-based Cloud IDS, Hybrid Deep Learning IDS, and Hierarchical Deep Learning IDS, the performance improvement is 1.07, 0.52, and 0.35% in terms of accuracy, 1.26, 0.68, and 0.45% regarding the F1-Score, while the improvement of false-positive rate is 1.39.

Authors

Veena Tewari
University of Technology and Applied Sciences-Ibri, Sultanate of Oman

Keywords

Cloud Security, Intrusion Detection, Multi-Stage Classification, Attention Learning, Artificial Intelligence