Improved Intrusion Detection Model Using Moderated Autoencoder for Feature Selection and Optimized Softmax Regression for Multiclass Classification of Attacks

Abstract

Cybersecurity researchers have always reckoned with the improvement of intrusion detection models to detect the multivariate types of attacks perpetrated by cybercriminals using the combination of machine learning algorithms to enable efficient intrusion detection systems. However, each proposed model comes with its drawbacks in the number of variant classes of attacks it can detect, and the required number of epochs is high, resulting in a longer processing time. In this paper, a moderated autoencoder (MAE) activated with the rectified linear unit (ReLU) is deployed for feature selection to reduce processing time by decreasing the number of epochs required to achieve optimal performance. Softmax regression (SR) optimized with adaptive moment estimation (ADAM) is used for the multiclass classification of attacks. The UNSW-NB15 dataset, including 10 classes-normal, analysis, backdoor, denial of service (DOS), exploits, fuzzers, generic, reconnaissance, shellcodes, and worms-was utilized for testing to assess the suggested approach. The UNSW-NB15 dataset is processed using the synthetic minority over-sampling technique (SMOTE) to prevent subpar performance brought on by dataset imbalance. The proposed model was trained and tested on a Jupyter notebook running the Anaconda Navigator environment with TensorFlow and Keras installed. Unlike the majority of state-of-the-art models that concentrated on a small number of evaluation measures, performance is evaluated across the five primary metrics of classification accuracy, precision, detection rate, <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{F 1}$</tex>-score, and false alarm rate. With a classification accuracy of 99.79, precision of 99.79, detection rate of 99.80, F1-score of 99.78, and false alarm rate (FAR) of 0.02 percent, respectively, the suggested model (MAESR) performs better than current models. It is recommended that future studies focus on examining the proposed model's dependability in real-world deployment and domain-specific settings.