MF-Net: Multi-frequency intrusion detection network for Internet traffic data.

The rapid growth of Internet technology renders intrusion detection an important research topic in the field of pattern recognition. Considering that traffic data relate to not only temporal information, but also attack frequency, this paper presents a novel deep learning framework termed the multi-frequency intrusion detection network (MF-Net). MF-Net regards the pattern of Internet traffic as a superposition of sequential data with various frequencies, and is able to recognize the multi-frequency nature of network traffic data. The core of MF-Net is the multi-frequency LSTM (MF-LSTM) and multi-frequency transformer (MF-Transformer) module, both of which consist of high-frequency and low-frequency layers. In comparison with other state-of-the-art approaches on 4 public datasets, namely UNSW-NB15, KDD Cup 99, NSL-KDD and CICIDS 2017, as well as an IPv6 traffic dataset we created, MF-Net has shown better result in both binary and multi-class classification, which demonstrates the superiority of MF-Net over other compared approaches on network traffic intrusion detection. [Display omitted] • MF-Net captures multiple frequencies features with both long-term and short-term dependencies. • Both MF-LSTM and MF-Transformer detect network intrusion data with different frequencies. • MF-Net achieve state-of-the-art performance on 5 network intrusion datasets. [ABSTRACT FROM AUTHOR]