Multiclass network attack classifier using CNN tuned with Genetic Algorithms

Intrusion Detection Systems (IDS) are implemented by service providers and network operators to monitor and detect attacks to protect their infrastructures and increase the service availability. Many machine learning algorithms, standalone or combined, have been proposed, including different types of Artificial Neural Networks (ANN). This work evaluates a Convolutional Neural Network (CNN), created for image classification, as a multiclass network attack classifier that can be deployed in a router. A Genetic Algorithm (GA) is used to find a high-quality solution by rearranging the layout of the input features, reducing the amount of different features if required. The tests have been done using two different public datasets with different ratio of attacks: UNSW (10 classes) and NSL-KDD (4 classes). Both classifiers distinguish correctly normal traffic from attack. However, in order to correctly classify the attack, the latter works better because it can be proportionate between the different classes, obtaining a cross-validated multi-class classifier with K of 0.95.