Exploring the Impact of Early Detection on DL-Based NIDSs Models
Minxiao Wang, Ning Yang, Ning Weng · 2023
Deep learning (DL) has been proposed as a promising solution for network intrusion detection systems (NIDSs). While most DL-based NIDSs focus on high accuracy, they often overlook the critical issue of NIDSs response time for intrusion behavior. Recently some existing works presented time-aware evaluation metrics or design DL-based solutions for early intrusion detection, yet they primarily focus on the post-performance of NIDSs, without thoroughly investigating the impact of early intrusion detection on DL-based NIDSs due to the black-box nature of DL models. To address this research gap, we explore the impact of early detection on DL-based models’ detection accuracy and input features. In our empirical study, we implement two different existing deep learning-based NIDSs methods and evaluate them on three published benchmark NIDSs datasets. Based on the experiment results on DL-based NIDSs detection accuracy, we observe that the early detection scenario will lead to the NIDSs model’s detection accuracy decreasing up to 50%. To understand the reasons behind it, we adopt the SHapley Additive exPlanations (SHAP) to analyze the importance of features and we observe the varying feature distributions. The feature importance and feature distribution results show that early intrusion detection may lead to a degradation of feature quality.