TSSAN: Time-Space Separable Attention Network for Intrusion Detection

Abstract

With the continuous evolution of novel network attacks, traditional Intrusion Detection Systems (IDSs) have commonly employed Deep Neural Networks (DNNs) for intrusion detection. However, the effectiveness of a DNN in this respect is closely related to the quality of the training data set, and large-scale network traffic data are difficult to label accurately. Therefore, some challenges still need to be addressed to detect network attacks. In this paper, we introduce a Time-Space Separable Attention Network (TSSAN) for intrusion detection. TSSAN utilizes depth wise separable convolution and a time-space self-attention mechanism to effectively extract temporal and spatial features. By extracting the common features from the unlabeled data, TSSAN significantly enhanced the detection performance for rare attack types. Experimental evaluations were conducted using UNSW-NB15 and CICIDS-2017 datasets. Meticulous experiments for evaluating the individual components of the model were rigorously carried out using the CICIDS-2017 dataset. In the unsupervised learning experiment, our method achieved 0.86 and 0.92 f1score in the two datasets. In semi-supervised learning, the experiment showed that our method performed significantly better than the traditional deep learning method when the labelled data were gradually reduced.

Keywords

• Intrusion detection
• deep learning
• network security
• self attention
• multi-class classification