| Journal: |
IEEE Open Journal of the Communications Society
IEEE
|
Volume: |
|
| Abstract: |
The emergence of new and more sophisticated threats in cybersecurity has necessitated the
improvement of security information and event management (SIEM) systems. The previous versions of
these security models faced numerous challenges, such as high false-positive and false-negative rates,
resulting in extensive unnecessary alerts or failure to identify real threats. This study discusses the use of
attention-based models for improving the performance of SIEM systems via an ensemble deep learning
framework. To this end, several types of neural networks, such as long short-term memory networks,
convolutional neural networks, and bidirectional recurrent neural networks, were used in this framework.
The resulting model could assess temporal patterns and significant characteristics from network data. To
reduce processing complexity and improve detection accuracy, an attention mechanism was used to let the
model focus on the most relevant parts of the input data. Additionally, alert prioritization was integrated
using fuzzy logic to rank threats based on factors such as the confidence level, impact, and frequency of
alerts, ensuring the more efficient handling of potential intrusions. An optimized ensemble strategy was
developed that incorporated different optimization methods to achieve high precision and speed, making
the model more robust against contemporary cybersecurity challenges. Experiment results show that the
new approach performs much better than other existing models. By splitting the training data into 70%
and 30%, the model achieved an accuracy of 98.52%, precision of 99.40%, F-measure of 97.08% and a
false negative rate (FNR) of only 1.14%. When the training data was split into 80% and 20%, the model
improved its accuracy to 99.28%, precision to 99.46%, F-measure to 98.67% and had a false positive rate
(FPR) of just 0.1%. Experiments revealed that the proposed model successfully detected and effectively
prioritized intrusions more effectively than other models while maintaining higher accuracy rates and
lower false alarm levels.
|
|
|