AI-Enabled Threat Detection using Deep Learning

Abstract

The advent of Internet of Things (IoT) and Cyber-Physical Systems (CPS) has led to the rapid development of highly dynamic and complex communication infrastructures in various domains ranging from healthcare, transportation, industrial automation to intelligent energy systems. Even though intrusion detection and network security is a wellresearched research area, existing intrusion detection systems cannot efficiently overcome shortcomings such as unknown threat detection, false-positive alert detection, network adaptivity and improved accuracy with large-scale real-time heterogeneous traffic data. In order to overcome these challenges, this paper proposes an AI-enabled threat detection framework using hybrid deep learning techniques for intelligent cyber threat analysis and intrusion detection. First, network traffic data is pre-processed, Min-Max-normalized, and enhanced by feature selection along with the Principal Component Analysis (PCA)-based dimension reduction to minimise the redundancy and to improve the quality of the dataset. Second, the optimized feature set is leveraged for AIenabled detection of anomalies using Autoencoder, spatial traffic patterns detection using Convolutional Neural Network (CNN), and the temporal dependencies of virtual attacks in traffic data using an LSTM-Recurrent Neural Network (LSTM-RNN). Finally, a hybrid Deep Neural Network (DNN) and Decision Tree classifier on the output of the hybrid model, classifies the normal and malicious network traffic with a reduced false-positive rate. Experimental results of the proposed framework on network intrusion datasets confirmed the efficiency of the proposed framework significantly outperforming the existing standalone deep learning approaches in terms of accuracy, precision, recall, F1-score, scalability, and real-time cyber threat detection.