STIDM: A Spatial and Temporal Aware Intrusion Detection Model

Abstract

Network intrusion detection plays a critical role in cyberspace security. Most existing conventional detection methods mostly rely on manually-designed features to detect intrusion behaviours from large-scale flow data. Recent studies show that deep learning-based methods are effective for network intrusion detection due to the ability to learn discriminative features from data automatically. However, these models ignore the problem of the irregular time intervals between packets in a flow, causing the degradation of detection performance. To this end, we propose a Spatial and Temporal Aware Intrusion Detection model (STIDM). The proposed STIDM model first uses a one-dimensional Convolutional Neural Network (1D-CNN) to extract spatial features based on the nature of flow and packet. Then we design a Time and Length sensitive LSTM (TL-LSTM) method to learn richer temporal features from the irregular flows. The two parts are trained simultaneously to achieve global optimum. Through extensive experiments on the ISCX2012 dataset and the CICIDS2017 dataset, we demonstrate that STIDM outperforms state-of-the-art models.