Shallow and Deep Learning Approaches for Network Intrusion Alert Prediction

The ever-increasing frequency and intensity of intrusion attacks on computer networks worldwide has necessitated intense research efforts towards the design of attack detection and prediction mechanisms. While there are a variety of intrusion detection solutions available, the prediction of network intrusion events is still under active investigation. Over the past, statistical methods have dominated the design of attack prediction methods. However more recently, both shallow and deep learning techniques have shown promise for such data intensive regression tasks. This paper first explores the use of shallow learning techniques for predicting intrusions in computer networks by estimating the probability that a malicious source will repeat an attack in a given future time interval. The approach also highlights the limits to which shallow learning may be applied for such predictive tasks. The work then goes on to show that deep learning approaches are much more suited for network alert prediction tasks. A recurrent neural network based approach is shown to be more suited for alert prediction tasks. Both approaches are evaluated on the same dataset, comprising of millions of alerts taken from the alert sharing system Warden operated by CESNET.