Authors - Ischyros Gangbo, Ghislain Vlavonou, Pelagie Houngue, Joel T. Hounsou, Fulvio Frati Abstract - One of the major phenomena in recent decade remains the massive proliferation of data, directly linked to the adoption and expansion of new technologies and the increasing automation of processes, affecting numerous fields such as the economy, education, and cybersecurity. This exponential increase in almost every area is accompanied by an intensification of threats. It is within this context that new approaches are being defined, as traditional security mechanisms are showing their limitations. To counter attacks, several tools, including intrusion prevention and detection systems (IDS), have been designed. IDS are devices intended to monitor an information system in order to react effectively in the event of an attack. To this end, IDS use mechanisms that allow them to listen to the system covertly in order to detect abnormal or suspicious activities and enable effective preventative action against the risks of intrusion. The objective of this article is to compare the performance of the following models: XGBoost, CNN, CNN-LSTM for multiclass classification with a hybrid model. The dataset was first transformed into a sequential format. CNN, CNN-LSTM, and XGBoost models were independently implemented as standalone classifiers to perform intrusion detection. Furthermore, a hybrid CNN-LSTM-XGBoost model was designed, where deep spatiotemporal features learned by the CNN-LSTM network were used as input to an XGBoost classifier for final decision-making. Comparative experimental results show that XGBoost and Hybrid models achieve effective detection performance, the hybrid architecture especially in detecting complex and minority attack categories.
Open Zoom