Low Complexity Shallow Neural Network With Improved False Negative Rate for Cyber Intrusion Detection Systems

Economic value creation increasingly takes place online or is tightly coupled to some kind of online service. At the same time, malicious network activities are causing growing losses in the strongly digitalized economies. Hence, protecting network communication infrastructure is an important challenge for companies and public institutions alike. Machine learning algorithm based network intrusion detection systems (NIDS) are often used to detect sophisticated attack patterns. However, the detection quality of those algorithms suffers greatly from the imbalanced nature of network flow data. Undetected attacks can cause great damage, so it is essential that a NIDS performs at its best in order to detect as many attacks as possible. In our article, we propose an improved loss function in order to reduce the number of false negatives produced by an artificial neural network (ANN). Based on the CIC-IDS17 dataset, we show that our proposed algorithm running on a shallow neural network (single layer with 110 neurons) successfully classifies a variety of recent network attacks with a F1-score above 99%.