An early discovery of intrusion attack using novel optimized deep learning for internet of things

The KDD99 dataset, which is over 19 years old, is still widely used by academic researchers. The training data was processed and approximately five million connection records were created. There are 41 features in the dataset, and it has been divided into 22 attack categories.

Denial of service attack (DoS): The goal of a DoS attack is to prevent a network or machine from being accessed by its intended users. It usually involves flooding a targeted system with requests to prevent it from processing traffic.

The primary goal of this attack is to steal or obtain data illegally, infect the victim with viruses, or cause damage.

Probing Attack: The initial step in an attack is referred to as scanning or discovery. It involves gathering information about a targeted system. During this process, a probe is performed to identify known vulnerabilities in software or in the custom code used for the targeted application.

3.2 Proposed Intrusion detection DBN model along with PSO-SVM-GBR

A network is equipped with an intrusion detection system to identify and prevent unauthorized access to a computer. This technology can also help prevent data from leaking or damaging. Due to its effectiveness, it has attracted increasing interest from both the private and public sectors. This type of technology can help improve the security of an organization’s information infrastructure.

In 2006, Hinton and colleagues [17] proposed the notion of deep learning. Deep neural networks are more complex and provide a better understanding of complex problems. They emphasize the importance of having a deep network’s multi-layer structure and features. On the other hand, shallow neural networks are often limited in their classification abilities. The original data is maintained even as the dimensions of the information change. Deep learning models are commonly used for analyzing complex problems, such as CNN and RBM.

The hierarchical structure of the Deep Learning algorithm’s DBN model makes it easier to process the collected data. The training phase involves training the various RBM networks and then training the weakest one on raw data. The lower layer’s output features are then used as input for the training process. The values of each layer can be acquired by training the RBM framework’s bottom-up approach. This method is repeated repeatedly with the goal of learning the various features of the data.

DBN models undergo a two-phase training process. The first phase is called the pre-training, while the second phase is known as the fine tuning phase. The first stage involves the use of the unsupervised algorithm to train the various layers of RBM. In the diagram below, the algorithm flow shows the steps involved in the training of each layer. The last layer of the RBM network is trained, which produces an output as a feature of the algorithm. The BP method ensures that errors are adjusted and sent back to the correct place. If the training goal isn’t met, the network will be retrained. The training duration of networks is also increased if they’re continuously trained. The goal is to perform network-level hierarchical learning.

The RBM is a two-layered model that has no self-feedback and symmetrical connections. In the model’s iterative process, the visible layer represents the observed data, while the hidden layer refers to the data that can be considered as a feature extraction. For convenience, it is assumed that the hidden and visible units are binary variables. ∀ i , j , v i ∈ { 0 , 1 } , h j ∈ { 0 , 1 } ,(1)

The state of the hidden unit is represented by h_j while the visible unit is represented by v_i.

The RBM’s precise iteration procedure is as follows:

In the visible layer v₁ of the network, take data and create the bias and weight values of the network.

The iterative process of training RBM is shown in the following steps. Each iteration updates the weights and offset values. After the training layer has been trained, the last RBM output is extracted and used as a feature. The goal of the program is to provide the best possible result.

When implementing the Gibbs algorithm for training RBM, there will be several sampling steps. This issue can occur due to the high data dimension. A CD algorithm is utilized to train the system, which segments it into several layers. This method then fine-tunes the parameters of the training.

In the second phase of the DBN training program, the model is fine-tuned. One of the most important factors that can be considered when it comes to achieving the weight of the RBM feature is the mapping of its feature vector. The BP network is also responsible for carrying out the error transmission. The DBN network’s error function indicates that the system has changed its weights and biases. This method can affect its efforts to achieve the ideal state. The training algorithm for this project aims to modify the network’s parameters to achieve the best result.

The number of hidden layers, number of nodes, and model iterations determine the capacity of the DB N framework to convey data attributes. Although it can do so, the parameters related its classification are not widely known. The training data set’s optimal number of hidden layers and nodes is determined by several experiments. One of the most important factors that determines the number of nodes needed for a given classification process is the number of hidden layers. A batch training method can be used to improve the efficiency of the process by randomly sampling the collected data set. The training data is then randomly selected and trained, and the network weight is continuously updated.

Large amounts of network data are required to perform well in machine learning.On the other hand, standard models can train well with small and high-dimensional datasets. A more efficient model is the SVM, which has better classification accuracy and faster running speed. The PSO algorithm is widely used in the selection of the SVM’s parameters. It can be used to analyze the collected data from the DBN platform and find the most suitable combination of parameters. The classifier trains the SVM and performs the final analysis to compare the results with those of other models.

The partition and optimization methods utilized in the PSO-SVM frameworks are designed to solve original problems while maintaining their characteristics. To avoid the emergence of random distribution of particles in the initial swarm, the algorithm’s initial position is adjusted. To optimize a given domain, divide it into equal parts and distribute the particles evenly across each subdomain. Then, through the SVM algorithm, solve the problem iteratively and get the best result.

This study aims to analyze the potential of deep learning to be used to attack various computer models. Besides this, it shows that attackers can also modify the operation of the proposed neural network by selecting its parameters, which makes it possible to alter its output. This will help in developing a better understanding of how these attacks can affect the real world. Since the design and structure of neural networks are intricate, it is crucial for researchers. Although other examples have been presented, the majority focus on these kinds of networks.

Analyzing large datasets using a sequential approach avoids breaking the neural network. Instead, GBR adds small trees with high bias to the dataset in order to focus on the document that caused the error. It performs gradient descent on an instance of space X1. R ( y i ) ← R ( y i ) - α K R ( y i ) ,(2)

Learning rates are computed by taking into consideration the number of times a feature has been exposed to it. The value of the negative gradient is then calculated by the prediction of regression trees. h t ≈ - arg min h ∈ T d ∑ i = 1 n ( h t ( x i ) - r i )(3) Y = ∑ i = 1 n ( g r ( y i ) - e i )(4)

The GBR algorithm takes into account the zero square loss condition in a given document and transforms it into its residual from its previous iteration. It is based on the standard CART algorithm. Another important factor that an algorithm should take into account when it comes to developing its algorithm is its learning rate, as it determines how many iterations it needs to complete the task.

There are three initial assumptions that are aimed at ensuring that deep learning models perform well. These include the ability to layer-by-layer process, feature transformation, and the sufficient complexity model. Deep learning techniques are typically processed by several layers. Since they lack the necessary features to make them more complex, they tend to be relatively easy to implement. The ensemble method, on the other hand, can make them more complex. This paper aims to analyze the advantages of implementing cascading structures and feature segmentation in deep learning. One of the main advantages of this approach is that it can improve the performance of the support vector machine. Another hypothesis suggests that the implementation of Spark-PSO could reduce the time it takes to detect and train models. The experiment involved converting character attributes into training models for different deep learning approaches. The results of the study can be found in the following sections.

4.1 Dataset description

The data sets are from the KDD CUP 99 benchmark, which was used by the AIPRS to analyze intrusion detection systems in 1999. The 494,021 records in the dataset represent various classifications attributes and numerical attributes. The benchmark’s four attack types are Denial of Service, Probe, Remote to Root, and User to Root.

4.2 Algorithm implementation

The process of implementing the algorithm involves pre-processing 10% of the training data and correcting the remaining KDD CUP 99 test data. After reducing the feature dimension, the proposed model trains the data according to the reduced feature dimension. The parameters of the training model are then adjusted to get the optimal ones. The test result is then verified and the algorithm is released. In network training, insufficient training can occur if the training number is too small. Overfitting can also occur if the training number is too large. The training number was initially set at 200, and after a hundred training iterations, the cost of the network decreased flat. The number of iterations was set at 100. The learning rate, initialization threshold, and gradient boost regression algorithm were also set.

4.3 Simulation results

Due to the importance of scientific papers in today’s society, organizations have to implement suitable security measures. An intrusion detection solution is utilized to identify and monitor anomalous activities. This system can be divided into two components: the control and surveillance domains. The latter is responsible for monitoring corporate networks and various applications. Figure 2 to 11 shows the implementation results of proposed framework.

OPEN IN VIEWER

Fig. 2

Model architecture for Proposed DBN.

In this study, we present a deep learning model called Spark DBN-PSO, which is designed to classify various types of data. The architecture of the model is shown in Fig. 2. After fine-tuning the model, five RBMs are composed of (49, 128), (128, 256), (256, 128), (128, 128), and (128, 64) respectively. The outputs from these RBMs are connected to a cluster of 6 nodes, which is used for multi-class classification. Table 1.

The table above shows the architecture of the DBN that is implemented using five RBMs. After fine-tuning the system, each of these is equipped with a set of hidden and visible nodes. The output of the last RBM is then connected to a layer that has 6 nodes for multi-classification using SVM function instead of softmax.