Lightweight Network Intrusion Detection System

Abstract

As the world becomes more connected, where more and more devices start to connect with each other through the Internet, people are more vulnerable to the growing threat of attack patterns. The current systems available in the market are good enough to identify abnormal traffic patterns within the network, but these usually come with a huge disadvantage of heavy computational overhead and latency issues to be truly useful for real-world scenarios. To tackle this issue, we propose a 2-stage solution consisting of a light binary model and a heavy multiclass model. The light binary model runs continuously, whereas the heavy model only runs when an attack is detected, thereby reducing the average compute and latency of the system. The system does not inspect the actual packet payload and also includes a real-time application that uses server-sent events (SSE) to readily notify the user about the status. On a subset of the CIC-IDS-2018 dataset, results show that the models have F1 scores of 94.2% and 92.5%, with model sizes being 3.10 MB and 9.56 MB, respectively. This overall application helps in reducing latency and computational overhead while also enabling us to take accurate, on-time actions to real-time threats.