Anomaly-based Intrusion Detection System (IDS) has been a hot research topic
because of its ability to detect new threats rather than only memorized
signatures threats of signature-based IDS. Especially after the availability of
advanced technologies that increase the number of hacking tools and increase
the risk impact of an attack. The problem of any anomaly-based model is its
high false-positive rate. The high false-positive rate is the reason why
anomaly IDS is not commonly applied in practice. Because anomaly-based models
classify an unseen pattern as a threat where it may be normal but not included
in the training dataset. This type of problem is called overfitting where the
model is not able to generalize. Optimizing Anomaly-based models by having a
big training dataset that includes all possible normal cases may be an optimal
solution but could not be applied in practice. Although we can increase the
number of training samples to include much more normal cases, still we need a
model that has more ability to generalize. In this research paper, we propose
applying deep model instead of traditional models because it has more ability
to generalize. Thus, we will obtain less false-positive by using big data and
deep model. We made a comparison between machine learning and deep learning
algorithms in the optimization of anomaly-based IDS by decreasing the
false-positive rate. We did an experiment on the NSL-KDD benchmark and compared
our results with one of the best used classifiers in traditional learning in
IDS optimization. The experiment shows 10% lower false-positive by using deep
learning instead of traditional learning.

本研究提出应用深度模型代替传统模型以减少误报率并通过使用大数据和深度模型获得更少的错误报告。在 NSL-KDD 基准测试上进行了实验，并与传统学习中最常用的分类器之一进行了比较，结果表明使用深度学习相对于传统学习具有较低的虚警率 10％。