Intrusion Detection on Switchports with LSTM as a Regression Problem

Abstract

With the rapid development of information technologies and smart devices, the protection of digital data has become an important issue. Intrusion detection systems (IDS) have become one of the indispensable security measures of today for the protection of digital data and for institutions and organizations to ensure service continuity. In this study, a method is presented to prevent attacks that may occur on the ports of switches used in online local networks. The Switchport Anomaly based Intrusion Detection System (SPA-IDS) dataset used in the proposed method is considered as a regression problem and the intrusion detection performance of the dataset is measured with the Long Short-Term Memory (LSTM). The performance values of the dataset used in the study were tested at different time step values and the highest estimated values were reached when the time step value was 10. Root-Mean-Square Error (RMSE) and R^2 score values were calculated as performance metrics in the study and the values of 0.0551 and 0.9953 were reached, respectively. Each data in the dataset used in the study was taken at one-second intervals. Therefore, the time step value of 10 indicates the data taken in 10 seconds. Attack detection is done quickly and with a high success rate based on data received every 10 seconds, which is an extremely positive outcome.