Hybrid Approach to Deep Packet inspection and Anomaly

Detection Using Deep Learning

Mhmd Hossiny, Nariman Shalash
Department of Computer Science, Misr International University, Cairo, Egypt

ARTICLE DATA ABSTRACT

Cyber threats continue to rise due to system vulnerabilities, increasing the need for effective
Network Intrusion Detection Systems (NIDS). However, existing NIDS often struggle with
high traffic loads and fail to accurately detect minimal impact, infrequent attacks. This study
proposes a hybrid deep learning model using 1D-CNNs combined with ANNs t o enhance
detection accuracy of AI. Our system performs deep packet inspection and employs adaptive
Keywords: NIDS, RL, FSM,
CNN, 1D-CNN, LSTM, KNN,
anomaly detection techniques. Experimental results on the CICIDS 2018 dataset
AI, SVM, APT, GRU, WSN, demonstrate that our model achieves 98.7% accuracy while maintaining a low false alarm
PCAP, DNN, rate of 1.3%, significantly improving cybersecurity solutions.

1. Introduction

The network security team faces challenges with accuracy and latency with intrusion detection. It does
not meet accuracy, so it needs human intervention and supervision. Notably, a key focus in intrusion
detection is using machine learning. This includes shallow learning techniques like Naive Bayes, Decision
Trees, and Support Vector Machines (SVM). Although these techniques improve detection accuracy,
additionally, they have limitations with scalability and latency. They need many of expert input. Experts
must use feature selection and preprocess the data gathered. This process is not only labor-intensive and
costly, but it is also prone to errors, leading to false positive classifications. Thousands and millions of
training data needed by the experts for the models to be used. This can take time, which can become
challenging in a real and dynamic network.

In our study, we propose a novel deep learning model to suit the detection operation within modern
networks. The model we propose is capable of correctly analyzing a wide range of network traffic. While
our primary focus is detecting SSH-brute force attacks, the system can be extended to other attack types
with further development.
We combine the power and accuracy of forward neural network that learns features by itself with GPU-
enabled TensorFlow and obtained promising results from analyzing the CICIDS 2018 datasets. We are
aware of the limitations of these dataset. but it remains widely used benchmark among similar works ,
enabling us to draw direct comparisons.

Decreasing the reliance on human operators is a crucial requirement for future- proofing NIDSs. Hence,
our aim is to devise a technique capable of providing reliable unsupervised feature learning, which can
improve the performance and accuracy of existing techniques. This system introduces our CNN, which is
a regularized type of feed forward neural network that learns features by itself via filter (or kernel)

1
optimization with multiple hidden layers. Fundamentally, this involves the proposed shift from the
encoder-decoder and towards utilizing just the encoder phase. The reason behind this is to give the correct
learning structure, it is possible to decrease both computational and time overheads, with minimal impact
on accuracy and efficiency. CNN can be used as a multi-dimensional unsupervised feature extractor that
scales well. In conclusion our aim is to achieve a NIDS capable of detecting intrusions in real time
without compromising accuracy with using the deep learning capabilities.

In this section, we delve into the challenges faced by modern NIDS and how deep learning can help
overcome these challenges, finally the approaches combining NIDS and deep learning all together. The
remainder of this paper is structured as follows. Section 2 presents relevant background information
collected to complete this study. Section 3 explains our proposed system architecture used in this study.
Chapter 4 specifies our proposed algorithm, which is subsequently evaluated in the evaluation & results
section. Finally, Section 5 discusses the dataset used by explaining why it was especially important in our
study.

Challenges of NIDS

Network Intrusion detection system encounter various challenges that are often overlooked yet essential
for their success. One significant issue is the data imbalance frequently found in training datasets, where
attacks occur much less often than normal traffic. This imbalance can result in high false positive rates or
inadequate detection of rare but critical attacks. Another concern is the susceptibility of NIDS to
adversarial attacks, where slight alterations in network traffic can deceive the system into misclassifying
harmful traffic as harmless. This problem is becoming increasingly relevant as the field of cybersecurity
advances. Additionally, the high dimensionality of network traffic data complicates the task of preserving
vital information while reducing features. This challenge intensifies when employing deep learning
methods, as it is crucial to select the right features without losing important attack signatures. Furthermore,
latency in real-time detection can pose a problem, particularly in hardware-accelerated systems like FPGA,
where there is often a trade-off between model complexity and performance. Lastly, NIDS must also
address the detection of zero-day and novel attacks, a challenge that is not often discussed but is essential
for providing strong protection against emerging threats.

Role of Deep Learning

Deep learning has been at the core of the advancements in machine learning in the recent past, bringing AI
closer to being. This domain is excellent in modeling relations of complexity and finding meaningful
abstractions through hierarchical levels of representation. Using supervised and unsupervised algorithms, it
makes high-level constructions from built-in lower-level constructs stratifying great models for intricate
data distributions.
Traditional techniques to detect intrusions often struggle. using signatures and rule-based effectiveness in
detecting changing attack patterns. Deep learning technology, employing architectures such as CNN, make
it capable to inspect complex network payload using SHH protocol, extract meaningful features, and detect
SHH-Brute Force attacks across the network with less reliance on human intervention.

For discovering SSH brute-force attacks, deep learning algorithms inspect a range of network flow
features, such as request attempt frequencies, session duration, packet sizes, and request interval times.
Sequence-based algorithms, such as Long Short-Term Memory (LSTM) networks or Gated Recurrent
Units (GRUs), work best in discovering spatio-temporal dependencies, discovering anomalous behavior
during the authentication stage, and discovering attack signatures even when attackers use distributed and
2
covert techniques. The architecture of CNNs makes feature extraction easier and allow for spatio-temporal
feature extraction, eliminating the need for feature engineering.

2. Related Work
NIDS are crucial for securing networked environments, and their study has gained significant attention.
As cyberattacks become more sophisticated, the demand for effective and adaptable NIDS has intensified.
A considerable amount of research has been dedicated to study machine learning and deep learning
techniques to enhance NIDS performance, particularly for real-time intrusion detection. Traditional
methods, such as signature-based and anomaly-based detection, face challenges in addressing the ever-
evolving landscape of cyber threats. Signature-based approaches can only recognize known attack patterns,
while anomaly-based methods often experience high false positive rates due to the unstable nature of
network traffic. In recent years, numerous studies have investigated the use of deep learning models for
NIDS, as these models can automatically extract features from raw network traffic, leading to improved
accuracy in identifying complex attacks. For example, Shone et al. (2018) [2]introduced a deep learning
method utilizing DNNs for NIDS, showcasing better performance compared to traditional machine
learning techniques (Shone et al., 2018). Their research indicated that deep learning models, especially
CNNs, can automatically learn spatial hierarchies of network features, thereby enhancing classification
accuracy. Likewise, Zhang et al. (2020) [3]presented IDSNet, a deep learning framework that combines
multiple layers of learning to boost detection accuracy and resilience against adversarial attacks (Zhang et
al., 2020). effectiveness of deep learning models in detecting complex attacks, particularly in situations
where conventional models fall short.
A significant area of research focuses on the development of lightweight deep learning models for
network intrusion detection systems (NIDS). This effort aims to lower computational demands and
facilitate real-time intrusion detection, particularly in environments with limited resources, such as
embedded systems and Internet of Things (IoT) networks. For instance, [4] introduced a lightweight
framework for intrusion detection in wireless sensor networks, highlighting the necessity of model
efficiency for real-time applications. Their approach effectively reduces computational load while ensuring
a high detection rate. Similarly, Niyaz et al. (2016) [5] created a deep learning-based system for detecting
DDoS attacks that utilized software-defined networking (SDN) to enhance resource allocation and
minimize latency. Their findings indicated that the combination of deep learning and SDN can
significantly improve real-time threat detection in high-traffic environments. Beyond deep learning,
another vital research area is the detection of zero-day attacks. The difficulty of identifying previously
unknown threats has sparked interest in unsupervised learning methods and hybrid models that merge
signature-based and anomaly-based techniques. Sharafaldin et al. (2018) [6] focused on generating new
datasets for training intrusion detection systems, which included attacks not represented in established
datasets like KDD99. This advancement allowed for more precise detection of novel and zero-day attacks.
Likewise, McHugh (2000) [7]emphasized the necessity of testing intrusion detection systems under diverse
conditions to ensure their capability to identify unknown threats and adapt to emerging attack strategies.
The vulnerability to adversarial manipulation is a significant issue researches has been studying. LeCun et
al. (2015) [8] highlighted how deep learning models can be misled by small, carefully designed inputs that
lead to misclassification, often without detection by traditional security measures. This challenge has
spurred recent research aimed at enhancing the robustness of NIDS against such attacks. One promising
strategy is adversarial training, where the model learns from adversarial examples during its training phase,
thereby boosting its resilience. Nonetheless, this field is still developing, as effective defense methods
against adversarial attacks continue to evolve. In summary, the research landscape for NIDS has made
notable progress, especially with the adoption of deep learning techniques that enhance detection accuracy,
minimize false positives, and improve the identification of new attack vectors. However, challenges persist
in real-time deployment, particularly in high-latency settings and under adversarial conditions. Ongoing

3
research aims to tackle these challenges while enhancing the efficiency and accuracy of NIDS to meet the
demands of modern network security.
Machine learning
Deep Learning
Large Language Model
Reinforcement learning

Reference Author Method Results Advantages Disadvantages

A Deep N. Shone, Stacked Non- Achieved high The model The usage of
Learning T. N. Symmetric detection accuracy performs well on KDD Cup 1999
Approach to Ngoc, V. Deep which outperforms new attack types, Dataset, which
Network D. Phai, Autoencoder traditional models. zero-day attacks. has a lot of
Intrusion and Q. (SNDAE). was able to detect The author used redundancies and
Detection Shi zero-day attacks deep learning outdated attack
(2018) more effectively. feature-based patterns.
Was able to feature learning The paper does
achieve a lower method instead of not have real
false alarm rate. manual feature time detection
selection. performance.
The paper Deep learning
demonstrates approaches
high performance require high
in intrusion computational
detection. power.
A M. E. Wireless The farmwork Light weight and The framework
Lightweight Karim, sensor used achieved low resource used is evaluated
Intrusion M. M. networks good detection detection system. in a simulated
Detection Rahman, (WSNs). with low false Reduces WSN rather than
Framework and S. Y. positive alarm computational real world
for Wireless Shin rate. overhead to deployment.
Sensor increase the While the paper
Networks lifetime sensor claims
(2018) nodes. scalability, the
Uses both real-world
signature-based performance on
and anomaly- large scale
based detection. network was not
fully evaluated.
A Deep Q. S. W. Unsupervised The proposed The autoencoders The system may
Learning- & J. A. autoencoders method achieves perform better face some
Based DDoS Y. Niyaz to detect high accuracy in than conventional scalability issues
Detection DDoS attacks known and unseen machine learning as network
System in in an SDN attack patterns. methods in traffic grows.
SDN (2016) environment. The approach identifying DDoS
shows improved attacks.
real-time detection The unsupervised
capabilities. learning
capability of the
autoencoders

4
 enables the
system to detect
unknown attacks.
The study
proposes a system
design

An Ensemble A. Al- Ensemble The proposed The model used Integrating

Deep Abassi et model, model outperforms reduces the need multiple deep
Learning- al. combining other classifiers for manual learning models
Based DNNs and such as random feature may require
Cyber- decision trees forest, standalone engineering. large
Attack DNNs, and The proposed computational
Detection in AdaBoost. design was resources for
Industrial 10-fold cross- effective in training and real-
Control validation on two handling time deployment.
System real ICs datasets. imbalanced data, The model relies
The approach is which enhances on the
designed to be robustness and availability of
easily integrated accuracy. quality data in
into existing ICS training.
infrastructures. Ensuring
seamless
integration in
ICS setups
without
disturbing
ongoing
operations may
be challenging.

3. Proposed System Architechture

The proposed system architecture is designed to enable real-time, high-performance network intrusion
detection by using a layered approach that ensures modularity, scalability, and efficient data flow. By using
deep learning-based classification, the system can swiftly detect SSH brute force attacks, with high
accuracy. Each layer is structured to handle specific tasks, from data acquisition to alert reporting, creating
a seamless and optimized intrusion detection pipeline.

3.1. Layered Architecture Approach

The proposed system architecture adopts a layered approach to achieve real-time, high-performance
network intrusion detection through deep learning. This design promotes modularity, scalability, and
efficient data flow while optimizing computational resources. The architecture is composed of six
essential layers: Data Acquisition Layer, Data Processing Layer, Intrusion Detection Layer, Alert &
Reporting Layer, Management & Control Layer, and Database Layer. Each layer has specific
responsibilities, contributing to a comprehensive intrusion detection pipeline that effectively identifies
cyber threats, particularly SSH brute-force attacks, in real-time.

The Data Acquisition Layer acts as the system's foundation, capturing live network traffic with a packet
sniffer and forwarding it to traffic aggregators. This aggregation process ensures that related packets are

5
grouped together, creating meaningful sequences that enhance analysis in subsequent stages. By
organizing the raw network data in this way, the system preserves vital information while minimizing
redundant data transmission.

The Data Processing Layer transforms raw network traffic into structured features suitable for deep
learning analysis. This layer includes a feature extraction module that identifies relevant attributes from
network packets, such as connection attempts, protocol types, session durations, and timing intervals. The
extracted features are normalized to ensure consistency in input representation, preventing bias from
varying data scales. The processed data is temporarily stored in a buffer, maintaining a steady data flow to
the detection engine and avoiding bottlenecks in real-time analysis.

The Intrusion Detection Layer serves as the system's foundation, the deep learning model to achieve fast
and accurate intrusion detection. The FPGA inference engine manages the pre-extracted features and
enhances the deep learning model's performance, enabling quick classification of network traffic. This
model, trained on a labeled dataset that includes both normal and malicious network behaviors, identifies
SSH brute-force attacks and other cyber threats by recognizing learned patterns. The classification module
sorts incoming network traffic into either normal or suspicious categories, forwarding the findings to the
next layer for reporting and response.

The Alert & Reporting Layer plays a crucial role in alerting system administrators about detected threats
and creating comprehensive incident reports. The alert system promptly issues warnings when suspicious
activity is detected, facilitating immediate threat response. At the same time, the report generator
assembles structured reports that detail the detected attack, including timestamps, source and destination
IP addresses, attack severity, and behavioral patterns. The user interface features an intuitive dashboard
that allows administrators to review alerts, analyze trends, and adjust detection settings, as necessary.

The Management & Control Layer grants system administrators’ full oversight of the NIDS. This layer
encompasses configuration settings that enable the customization of detection thresholds, model
parameters, and alert preferences. The system monitor (dashboard) offers real-time visualizations of
system performance, detected threats, and network traffic analytics. Authorized personnel can access
admin features to supervise system operations, update detection models, and manage security policies.

The Database Layer plays a crucial role in storing and managing important system data. It features an
anomaly log database that records detected security incidents for later analysis. The system metrics
database keeps track of performance logs, such as processing times, detection accuracy, and resource
usage, which helps in ongoing optimization. Additionally, the training data repository holds labeled
datasets that are used to train and refine the deep learning model, facilitating continuous enhancement of
attack detection capabilities.

6
 Figure 1 Proposed system Architecture.

3.2. 1D-CNN Architechture

Pattern Recognition Beyond Traditional Methods

1D CNNs stand out from traditional rule-based or statistical anomaly detection methods by automatically
identifying attack signatures without needing prior domain knowledge [9]. This feature is especially
beneficial for spotting zero-day attacks and adversarial traffic, where attack behaviors are constantly
changing.

Resilience to Feature Engineering Bias

In conventional NIDS methods, feature selection can introduce bias since it depends on manually selected
features based on past attack patterns. In contrast, 1D CNNs dynamically learn the best feature
representations, making them more flexible in responding to new and complex cyber threats. [10]

Effective SSH Brute-Force Attack Detection

Temporal Pattern Learning: 1D CNNs identify SSH brute-force attacks by detecting irregularities in
authentication attempts over time. Unlike signature-based IDS that depend on predefined attack
fingerprints, CNNs can recognize new variations of brute-force attacks by learning patterns from raw
traffic.
High Precision and Low False Positives, by training on both attack and normal traffic datasets ( KDD 99,
CIC-IDS 2017) [11]

7
4. Proposed Algorithm
To achieve real-time network intrusion detection with high accuracy and efficiency, we propose a deep
learning-based approach leveraging a one-dimensional convolutional neural network (1D-CNN). This
section details the core components of our proposed method.

4.1. 1D-CNN
A 1D Convolutional Neural Networks (1D-CNN) is a specialized deep learning architecture designed to
extract meaningful spatial patterns from sequential data. Unlike 2D CNNs. 1D-CNNs are commonly used
for image processing, 1D CNNs operate on one-dimensional sequential data, making them particularly
effective for analyzing network traffic, time-sesiteve data, and log sequences into our intrusion detection
system (IDS). The architecture consists of 6 main layers, each playing an important role in feature
extraction, transformation, and classification. We will break those layers to help explain the process and
role of each layer.

In our study, the input received from the dataset is sent to be preprocessed, encoded, normalized, balanced,
checked from null values. Then, the extracted features are fed as a 1D vector, where each dimension
corresponds to a particular network characteristic over time. The output of number passes to the next layer,
convolutional layer applies 1D filters (kernels), unlike traditional feature selection methods that rely on
domain expertise, CNNs learn feature representations automatically, identifying subtle attack patterns that
might be overlooked by conventional approaches.

Figure 2: 1D-CNN Layers

5. Dataset
The CICIDS 2018 dataset is the most comprehensive and realistic benchmark for evaluating IDS,
especially for machine learning and deep learning models. Developed by the Canadian Institute for
Cybersecurity (CIC), this dataset was collected to overcome the limitations of older datasets like KDD99
and NSL-KDD which have outdated attack patterns, redundant records, and lack of real-world traffic
diversity. CICIDS 2018 dataset was collected in a controlled yet highly realistic environment, simulating
8
modern network traffic and attacks while maintaining traffic flow characteristics. This dataset is a
goldmine for cybersecurity research, with labeled data for both normal and malicious traffic, covering a
wide range of contemporary attack types including SSH brute-force, botnets, DoS, and web attacks.

5.1. Dataset Background

The dataset was collected by simulating an enterprise network over a period of 10 days, capturing real-
world attack scenarios in a structured way. This network had multiple victim machines running different
operating systems (Windows, Linux, macOS), legitimate users performing routine activities (browsing,
emailing, file transfers) and an adversarial component executing manual and automated cyber-attacks. One
of the unique features of this dataset is that it includes traffic from Tor network-based attacks, encrypted
malicious activity and anonymized traffic, making it more challenging and realistic than older datasets.
Each network flow in CICIDS 2018 was collected using CICFlowMeter, a tool that extracts 80 network
traffic features, including packet size distributions, inter-arrival times, byte counts, and protocol-based
behaviors. This level of granularity is especially useful for deep learning-based anomaly detection, as it
allows models to learn complex temporal patterns in network traffic.

5.2. Why CICIDS 2018 Valuable for SSH Brute-Force Detection?

Among the various attack types recorded in this dataset, SSH brute-force attacks stand out as
particularly critical. These attacks involve repeated login attempts on a secure shell (SSH) server, utilizing
automated scripts that try different combinations of usernames and passwords. Unlike other brute-force
datasets that merely log failed login attempts, CICIDS 2018 offers a complete packet capture (PCAP) of
the attack sessions, enabling a thorough examination of attack behaviors, such as Irregular authentication
attempts: A pattern of repeated failed logins followed by an unexpected success. Attackers often rotate
through various IP addresses or employ botnets to spread out their login attempts [12].A firewall should
easily block these behaviors, so it looks for specific features. While legitimate SSH traffic tends to follow
predictable patterns, brute-force attacks create statistically significant deviations in packet inter-arrival
times and payload structures. One of the most unique and informative features of CICIDS 2018 is its
capacity to reveal malicious port usage that strays from typical network behaviors. For instance,
Destination port 22 is the standard SSH port, and brute-force attacks usually involve quick authentication
attempts on this port. However, CICIDS 2018 shows that attackers frequently target non-standard ports to
avoid detection. While destination port 53, generally used for DNS queries, has been noted in some attack
scenarios, suggesting possible DNS tunneling techniques where SSH brute-force attempts are hidden
within what appears to be normal DNS traffic [13].
Unexpected use of ephemeral ports: SSH brute-force tools may sometimes connect through high-numbered
ephemeral ports (49152–65535) to circumvent static security system rules.

Traditional intrusion detection systems face challenges with stealthy brute-force attacks, where login
attempts are spread out over extended periods to evade standard rate-limiting measures. The CICIDS 2018
dataset offers time-series attack data [14], allowing deep learning models (like 1D CNNs and LSTMs) to
examine the gradual increase in login attempts over time. The shift from failed logins to successful
breaches, which could suggest credential stuffing or compromised credentials. Also, it changes in response
packet sizes, which may indicate whether a system is sending different failure messages based on the
attacker's progress. Additionally, CICIDS 2018 features a variety of attack vectors, including: Dictionary-
based SSH brute-force (utilizing a predefined list of credentials). Intelligent brute-force (where attack tools
modify their tactics based on server feedback). Distributed brute-force (employing multiple IP addresses to
distribute login attempts, complicating detection). This dataset is among the few publicly accessible

9
collections that document real-world SSH brute-force attacks across various methodologies, making it
essential for assessing next-generation intrusion detection systems.

Attacks Category Total Training Testing

(eligible) (eligible)
Benign Benign 227309 20000 20000
7
DoS DDoS 128027 2700 3300
DoS slowloris 5796 1350 1650
Dos slowhttptest 5499 2171 1169
Dos Hulk 231073 4500 5500
DoS GoldenEye 10293 1300 700
HeartBleed 11 5 5
PortScan PortScan 158930 3808 4192
Bot Bot 1966 936 624
Brute- FTP 7938 900 1100
Force SSH 5897 900 1100
Web Web Attack-Brute Force 1507 910 490
Attack Web Attack-XSS 652 480 160
Web Attack-SQL Injection 21 16 4
Infiltration Infiltration 35 24 6
Total Attack 471454 20000 20000
Total 283074 40000 40000
3
Figure 3: CICIDS 2018 Attack Types

Identifying SSH brute-force attacks, a common attack in which attackers try to gain unauthorized access
through a systematic testing of username and password combinations [1]. Traditional techniques rely on
threshold approaches, such as tracking failed logins in a specific period. However, such approaches can
cause high false positive rates or miss slow-rate brute-force attacks that make login attempts over a long
duration to evade detection. Deep learning algorithms overcome such weaknesses through distinguishing
complex spatio-temporal and temporal relationships in network traffic information, allowing for
distinguishing between normal logins and suspicious brute-force activity.

6. Evaluation And Result

In this section, we assess the effectiveness of our proposed 1D Convolutional Neural Network (1D-
CNN) in detecting SSH brute-force attacks using the CICIDS 2018 dataset. The evaluation focuses on
various performance metrics, such as accuracy, precision, recall, F1-score, and computational efficiency.
Additionally, this section offers insights into the dataset processing, model training, and key observations
derived from the results.

10
6.1. Preprocessing and Dataset Handling

Figure 4 1D-CNN Model

The CICIDS 2018 dataset comprises a range of
network traffic logs that feature both benign and attack
patterns. Due to the substantial amount of data, we
implemented the following preprocessing steps to
optimize model performance. Feature Selection and
Normalization: The dataset contains over eighty features,
but we selected only the most pertinent ones based on
their relevance to attack detection. We normalized these
features using Min-Max Scaling [15]to improve the
CNN’s ability to learn patterns effectively. Data
Labeling: The dataset initially includes categorical
labels, which we converted into numerical values

11
through one-hot encoding, allowing the CNN model to process them more efficiently. Managing
Imbalanced Data, given that some attack classes may be underrepresented, we employed Synthetic
Minority Over-sampling (SMOTE) to balance the dataset, thus avoiding bias towards benign traffic. Train-
Test Split: We divided the data into 80% for training and 20% for testing, ensuring that the model can
generalize well to new, unseen data.

6.2. Model Training

We trained the model using Categorical Cross-Entropy Loss and optimized it with the Adam optimizer.
The training process lasted for 50 epochs with a batch size of 32, which helped maintain stability in
learning while avoiding excessive computational demands. Throughout the training, we monitored
performance in real-time to mitigate overfitting through early stopping and dropout layers.

6.3. Performance Metrics and Evaluation

After training, the model was evaluated using the test set, yielding the promising results. The accuracy
achieved by the model was an impressive accuracy of 98.7%, highlighting its effectiveness in classifying
network traffic. The precision for SSH brute-force attacks stood at 97.9%, while the recall was 98.5%,
indicating a low rate of false positives and false negatives. While the overall F1-score reached 98.2%,
confirming the model’s robustness. And The Receiver Operating Characteristic - Area Under Curve (ROC-
AUC) score was an outstanding 99.1%, highlighting the model's strong ability to distinguish between
attack and benign traffic. On the other hand, the false alarm rate was kept to a minimum at 1.3%, making it
a dependable solution for real-world applications.

Metric 1D-CNN-Based IDS K-Nearest Neighbors Long Short-Term

(KNN) Memory (LSTM)
Accuracy 98.7% 89.6% to 98.23% 82.74% to 97.77%
Percision 97.9% 71% to 90% 76.49% to 96.8%
Recall 98.5% 95,2% 99.75%
F1 Score 98.2% 98% 99.5%
ROC-AUC Score 99.4% 99.82% 99.1%
False Alarm Rate 1.3% 0.59% 1.5%

6.4. Observations and Insights

The destination port 53, commonly linked to DNS, was often a target in attacks, underscoring its
susceptibility. SSH brute-force attacks displayed unique traffic patterns, characterized by quick successive
connection attempts and brief session durations. SSH showed irregularities in packet inter-arrival times,
which were vital for the detection process. Therefore, the model successfully distinguished between
genuine SSH traffic and attack patterns, thanks to the hierarchical feature extraction capabilities of CNN.
Analyzing packet payload characteristics indicated that attackers frequently employed varying payload
sizes to avoid detection, but CNN effectively learned to identify these irregularities. The existence of
encrypted traffic did not significantly impact detection performance, as the model utilized metadata-based
features like connection duration, packet size distribution, and request-response timing.

12
7. Conclusion
This paper introduces a hybrid deep learning approach for network intrusion detection that overcomes
the shortcomings of traditional NIDS. By leveraging the advantages of both deep learning and
reinforcement learning, the proposed system demonstrates impressive accuracy in identifying SSH brute-
force attacks and various other cyber threats, even in busy and changing network environments. Its
capability to analyze packet payloads and adjust to new attack methods in real-time positions as a strong
solution for contemporary cybersecurity issues.
The evaluation results highlight the success of the proposed 1D-CNN model, which achieved an accurate
rate of 98.7% and a low false alarm rate of 1.3% on the CICIDS 2018 dataset. The model's high precision
and recall rates reflect its effectiveness in accurately detecting SSH brute-force attacks while keeping false
positives to a minimum. Moreover, the system's modular and scalable design allows for deployment across
different network settings, ranging from small IoT networks to extensive enterprise systems.
looking forward, we aim to broaden the system's capabilities to identify a wider array of cyber threats,
including advanced persistent threats (APTs) and zero-day attacks. We also intend to investigate the
integration of additional Deep Learning methods, such as artificial neural networks (ANNs), to further
improve the system's capacity to detect intricate and distributed attacks. By continually enhancing the
system's detection accuracy and adaptability, we aspire to deliver a thorough and effective solution for
safeguarding modern networks against evolving cyber threats.

References

[1] H. &. Z. Z. Wang, "Anomaly detection in network intrusion using deep recurrent neural networks,"
Neural Processing Letters, vol. 49(3), pp. 999-1010, 2019.
[2] N. N. T. N. P. V. D. &. S. Q. Shone, "A deep learning approach to network intrusion detection," IEEE
Transactions on Emerging Topics in Computational Intelligence, vol. 2(1), p. 41–50, 2018.
[3] H. D. S. &. Z. Y. Zhang, "DSNet: A deep learning approach for intrusion detection," Electronics, vol. 9(8),
p. 1178, 2020.
[4] M. E. R. M. M. &. S. S. Y. Karim, "A lightweight intrusion detection framework for wireless sensor
networks.," Sensors, 18(8), 2473., 2018.
[5] Q. S. W. &. J. A. Y. Niyaz, "A deep learning-based DDoS detection system in SDN.," arXiv preprint,
1611.07400., 2016.
[6] I. L. A. H. &. G. A. A. Sharafaldin, "Toward generating a new intrusion detection dataset. In Proc. 4th
Int. Conf. Information Systems Security and Privacy," (ICISSP), p. 108–116, 2018.
[7] J. McHugh, "Testing intrusion detection systems. ACM Transactions on Information and System
Security," TISSEC, vol. 3(4), p. 262–294, 2000.
[8] Y. B. Y. &. H. G. LeCun, "Deep learning.," Nature, vol. 521(7553), p. 436–444, 2015.
[9] M. &. G. A. A. Sadeghi, "Intrusion detection systems: A survey and classification. Journal of Network
and Computer Applications," Journal of Network and Computer Applications, vol. 65, pp. 96-122, 2017.
[10] Y. &. C. X. Liu, "Using deep convolutional neural networks for network intrusion detection.," 2019 14th
International Conference on Computer Science and Education (ICCSE), pp. 124-129, 2019.
[11] H. &. B. H. Farad, "Deep learning-based attack detection in industrial control systems.," 2020
International Conference on Smart Communications and Networking (SmartNet), pp. 78-84, 2020.
[12] T. &. M. S. Aziz, "A novel intrusion detection approach based on deep autoencoders for network
security," ournal of Electrical Engineering & Technology, vol. 15(4), pp. 1353-1363, 2020.
[13] I. H. &. Z. F. Sarker, "Survey on network intrusion detection systems using deep learning: Approaches,
challenges, and future directions.," Computers, vol. 9(4), p. 67, 2020.
[14] M. A. &. M. S. Mollah, "Network intrusion detection with hybrid deep learning-based techniques," Soft

13
 Computing, vol. 25(4), pp. 1861-1874, 2021.
[15] L. &. H. R. Bai, "Deep learning-based feature selection for intrusion detection in networks.,"
Computers, Materials & Continua, vol. 64(2), pp. 993-1010, 2020.

14