Deep Learning Based Hybrid Intrusion Detection Systems to Protect Satellite Networks

A satellite is a self-contained communications device with the capacity to receive messages from Earth and retransmit them using a transponder, which functions as both a radio transmitter and receiver. Thanks to the satellite, large areas of Earth may be seen at once. As a result, satellites can gather data more quickly and efficiently than devices on the ground, as shown in Fig. 1. The ability of satellites to transmit signals from one place to numerous destinations is their fundamental benefit. As a result, “point-to-multipoint” communications like broadcasting are perfect for satellite technology [1]. Satellite communication is the best option for underserved and remote locations with dispersed populations because it doesn't require significant investments on the ground. However, the satellite-terrestrial network has significant issues with networks that are growing daily, enormous devices, the inclusion of the satellite network, data security, and data privacy [2]. Another issue is that the satellite network has less computing power and resources than the terrestrial network. A satellite node that has been targeted by an attacker becomes quickly exhausted and is challenging to repair. Therefore, high-level protection for modern networks requires the development of effective intrusion detection techniques. To address these issues, further classification algorithms are presented. Therefore, high-level protection for modern networks necessitates the development of effective intrusion detection techniques due to the rise in network intrusion attacks [3].

There is a greater demand for network security due to the rise in network intrusion attacks [3, 4]. Cybersecurity is playing a crucial role in satellite system protection through the application of security policies, confidentiality, and integrity. Intrusion detection systems (IDSs) are utilized to detect attacks and any abnormal behavior in satellite systems [5]. IDS is categorized into five categories, as shown in Fig. 2. IDSs can be divided according to their structure: Based on centralized IDS or distributed IDS. The centralized IDS analyses data at a set number of locations [10]. The distributed IDS, which includes multiple IDS through a large network, all of which are connected to each other or connected to a central server that provides advanced network monitoring and incident analysis, can also be divided according to their deployment location into host-based intrusion detection systems (HIDS) and network-based intrusion detection systems (NIDS) [8]. HIDS in the IDS system uses the activities of the system in the form of different log files running on the local host computer to detect attacks, but NIDS in the IDS system uses network behavior. The network behaviors are gathered using network equipment through mirroring by networking devices, such as routers, switches, and network taps, and analyzed to specify attacks and possible threats hidden within network traffic. The log files in NIDS are gathered through local sensors. While HIDS depends on the information in log files, which include system logs, sensor logs, file systems, software logs, user account information, disc resources, and others for each system, NIDS inspects the contents of each packet in network traffic flows. Many organizations utilize a hybrid of both HIDS and NIDS [8].

In addition, IDS can be divided according to the approach that is used to detect attacks and other hidden potential threats within network data [3‐8] into two categories: Anomaly-Based detection and Signature-Based detection, also known as “misuse detection” or “knowledge-Based detection”. Anomaly-Based detection has the feature of detecting deviations from normal behavior. The role of this technique is to: establish a baseline for the normal behavior of network traffic, then compare the incoming traffic with this baseline to detect malicious attacks. This IDS type enables detecting unknown attacks as well as known attacks [9]. Signature-Based detection has predefined signatures for known attacks that are matched with all connection patterns in the network to detect and stop any anomalous attacks. The main advantage of this type of IDS is that it detects known attacks. However, the unknown attacks are not detected due to the unavailability of attack signatures [9].

According to their response, IDSs are classified into passive IDS, which monitor, log, and provide alerts to activity, and active IDS, which act based on software design [10].

Based on the above figure, the proposed ML/DL-based hybrid IDSs in this research study focused on signature-based IDSs. It provides a high level of security for both satellite and terrestrial networks by detecting known attacks and improving the accuracy of the results.

This section focuses on some recent related works on intrusion detection systems using UNSW-NB15 for terrestrial datasets and/or STIN for satellite datasets. Researchers in [11] provide a comprehensive review of the latest feature selection (FS) methods in large data sets, organized based on their nature, like search strategy, evaluation process, and feature structure.

The authors in [5] proposed a new approach-based intrusion detection method using data from satellite and terrestrial networks. The model combines random forest (RF) and multilayer perceptron (MLP) to increase the accuracy of intrusion detection compared to other machine learning models. They also analyze the efficiency of the proposed framework for the satellite and then use three datasets for experiments, namely NSL-KDD, KDD-CUP 99, and STIN. Other researchers [12] analyzed the important features of huge traffic in networks to improve the accuracy of the intrusion detection model and minimize the execution time. They use the Information Gain method as a feature selection method to select important features and then implement Bayes Net (BN), Random Forest (RF), Naive Bayes (NB), J48, and Random Tree (RT) classifiers. The results of experiments on the CICIDS-2017 dataset improved the accuracy and execution time, and the Random Forest model (RF) achieved the highest accuracy of 99.86% based on 22 selected features, while the J48 model achieved an accuracy of 99.87% based on 52 selected features but with a longer execution time. The authors in [13] proposed a comparative study on Artificial Intrusion Detection Systems (AIDS) using different datasets and different types of attacks. They also apply different supervised ML algorithms such as random forest (RF), decision tree (DT), k-nearest neighbour (k-NN), support vector machine (SVM), naive Bayes (NB), artificial neural network (ANN), and convolutional neural network (CNN) algorithms, as well as unsupervised ML algorithms including k-means, expectation–maximization (EM), and self-organizing maps (SOM) algorithms. In [8], the authors propose an alert system based on hybrid intrusion detection through a highly scalable framework. The proposed framework handles large-scale data in real time.

The authors in [14] proposed a UAV and satellite-based 5G network security model based on machine learning to enhance the security of networks by effectively detecting vulnerabilities and cyberattacks. This approach is divided into two parts: the creation of the model using different machine learning algorithms and the implementation of the ML-based model using satellite or terrestrial gateways. This model achieves maximum accuracy with a 99.99% true negative rate and a 0% false negative rate by using a decision tree algorithm rather than other ML classifiers. Other researchers [15] proposed deep learning model-based intrusion detection using hybrid sampling to solve the problem of data imbalance. To produce a balanced dataset, they use one-sided selection (OSS) to reduce the majority samples and increase the minority samples using the Synthetic Minority Over-Sampling Technique (SMOTE). Then they implement Bi-directional long short-term memory (BiLSTM) using the NSL-KDD and UNSW-NB15 datasets, and they achieve 76.82% for multiclass classification and 77.16% for binary classification. In [16], authors proposed a new approach-based intrusion detection and compared it with different machine learning techniques, including SVM, AdaBoost, decision tree, and MLP, to classify normal and anomalous traffic. It depends on selected features based on the correlation between the features, and it implements using the UNSW-NB 15 dataset for network anomaly detection. The proposed approach achieves high accuracy in binary classification using Adaboost, which is 99.3%.

Researchers in [17] proposed an overview of different feature selection methods to reduce the computation time and improve the accuracy of the prediction. They focus on explaining the filter, wrapper, and embedded methods with various machine learning classifiers. Authors in [18] implemented a filter-based XGBoost algorithm using UNSW-NB15 to reduce feature space and then used ML approaches such as k-Nearest-Neighbour (kNN), Logistic Regression (LR), Support Vector Machine (SVM), Decision Tree (DT), and Artificial Neural Network (ANN). The results based on XGBoost-based feature selection achieve high test accuracy for the DT model, ranging from 88.13% to 90.85% in binary classification. The authors in [19] applied a Gated Recurrent Units (GRU) classifier based on deep learning to detect DDoS and intrusion attacks in a software-defined network (SDN). Other researchers in [20] studied the effect of different feature selection techniques such as Chi-Square, Information Gain (IG), and Recursive Feature Elimination (RFE) on the performance of ML classifiers, namely Naïve Bayes, Decision Tree Classifier, Support Vector Machine, k-nearest neighbours, Random Forest Classifier, Logistic Regression, and Artificial Neural Networks. Authors in [21] proposed a new hybrid approach using chi-square as a feature selection technique, Extra Tree, and ANOVA with ML classifiers such as Random Forest, k-Nearest Neighbours, Decision Tree, and XGBoost to detect DDoS attacks on IoT devices.

The authors in [22] presented an automatic evaluation method based on human–computer interaction and virtual reality for mental health physical examination. They use the HCI technique to induce the participants’ emotional experience via three virtual reality (VR) emotional scenes: sad, joyful, and calm, and construct two differential pupil-waves for sad and joyful with the calm pupil-wave as the baseline. Researchers in [23] developed ECMADE, which is proposed to solve premature convergence and search stagnation. When compared to other algorithms, ECMADE outperforms them in terms of solution quality, space distribution, and robustness. Other researchers in [24] presented a multi-strategy competitive-cooperative co-evolutionary algorithm based on adaptive random competition and neighbourhood crossover, namely MSCOEA, to effectively solve multi-objective optimization problems (MOPs) and fully balance uniformity and convergence. The authors in [25] proposed a long short-term memory (LSTM)-based approach to detect network attacks using an SDN-supported intrusion detection system in IoT networks. They effectively identify the attacks and classify the attack types with an accuracy of 0.971. Researchers [26] proposed an approach that combined both CNN and GRU to optimize the network parameters. In this simulation, the authors used the CICIDS-2017 benchmark dataset and metrics such as precision, recall, false-positive rate (FPR), and true-positive rate (TPR). The authors also performed a comparative analysis with other existing approaches, and the obtained results indicate the efficacy of the proposed IDS scheme in real-world cybersecurity setups. Others [27] developed a deep learning model for network intrusion detection in both binary and multiclass classifications of network traffic. They also proposed an effective refinement strategy and generated several models for lowering the FNR and increasing predictability for the minority classes. Researchers in [28] proposed LSTM (Long Short-Term Memory) combined with FCN (Fully Connected Network) deep learning approaches to classify the normal and anomalous connections on intrusion datasets and specify the attack pattern more accurately. The proposed deep learning model achieved a better classification accuracy result using the KDDCup99, NSLKDD, GureKDD, KDDCorrected, Kyoto, and NITRIDS datasets, respectively. The authors in [29] proposed an unsupervised ensemble autoencoder connected to the Gaussian mixture model (GMM) to adapt to multiple domains. The performance of the proposed model is comparable with the selected anomaly detection baselines using three public datasets.

In recent related works on IDS, previous authors proposed many approaches to improving the accuracy results in binary and multi-class classification by combining two techniques with each other or solving an imbalanced dataset. As a result, some researchers proposed filter methods such as Chi-square and Information Gain, which were combined with ML models to improve accuracy. Other researchers proposed solutions to the imbalanced dataset problem, such as the SMOTE technique, which also increases accuracy. Their findings included some problems: mainly the low accuracy of the adapted models combined with more execution time and complexity time according to the number of used features. Many researchers used terrestrial network traffic as a dataset to evaluate those proposed approaches, as shown in Table 1.

This section explains in detail the two datasets for satellite and terrestrial networks, STIN and UNSW-NB15, respectively. Then, the ML and DL models, which are implemented in the proposed SAT-IDS approaches to detect different satellite-terrestrial attacks, were reviewed.

Inspired by ML/DL techniques, four hybrid IDS techniques are proposed. The first technique depends on using RF combined by SFS (RF-SFS), the second technique depends on using ANN combined by SFS (RF-SFS-ANN), the third technique depends on using LSTM combined by SFS (RF-SFS-LSTM), and the fourth technique depends on using GRU combined by SFS (RF-SFS-GRU). A subset of high-performing features was chosen from the datasets STIN for satellite networks and UNSW-NB15 for terrestrial networks by using sequential forward selection (RF-SFS) to reduce the complexity and dimensionality of the features. As a result, 10 features were selected from the whole set of features for each dataset. Therefore, the selected features are combined with ML and DL models to detect intrusions.

Kaggle [44] was used as the experimental environment. Kaggle notebooks run in a remote computational environment. It has 20 gigabytes of auto-saved disc space (/kaggle/working).

Scikit-Learn, Numpy, Pandas, Matplotlib, and other packages were also used to provide data processing, feature selection, and visualization functions [44] to analyze the performance of the proposed SAT-IDSs.

The previous section presented a performance analysis and comparison of the four ML/DL-based RF-SFS techniques. The RF-SFS feature selection technique is exploited to significantly reduce the execution time of training and testing data by minimizing the number of selected features while enhancing the accuracy of intrusion detection. It selects 10 features among 32 features and 45 features using the STIN and UNSW-NB15 datasets, respectively.

When applying to the STIN dataset, the accuracy of the RF classifier increased by using RF-SFS from 85.41% to 90.50%, and the accuracy of the ANN classifier increased from 63.61% to 71.47%. Furthermore, by using RF-SFS with an LSTM classifier, the accuracy increased from 82 to 86%. In the last approach, the accuracy of the GRU classifier increased from 79 to 87%. The experimental results demonstrate that the RF-SFS-GRU classifier achieved a higher accuracy score in the UDP_DDoS attack than the RF-SFS-LSTM classifier. In addition, RF-SFS-LSTM and RF-SFS-GRU IDS recorded higher detection accuracy for Syn_DDos than RFMLP [5]. When applied to the UNSW-NB15 dataset, the accuracy of the RF classifier increased by using SFS-RF from 75.4% to 78.5%, and the accuracy of the ANN classifier increased from 69.05 to 78.23%. Furthermore, by using RF-SFS with an LSTM classifier, the accuracy increased from 75 to 78%. In the last approach, the accuracy of the GRU classifier increased from 74 to 79%. The experimental results also demonstrate that the RF-SFS-GRU classifier achieved higher accuracy results than other proposed approaches. The proposed RF-SFS-GRU and RF-SFS-ANN IDS achieved higher accuracy and precision, respectively, than the approaches in [18].

The requirement for cybersecurity solutions to prevent attacks in the modern network environment has increased along with the number of network intrusion attacks. To provide a high level of security for both satellite and terrestrial networks, four ML/DL based hybrid IDSs are proposed in this paper. The proposed models are evaluated and verified using the UNSW-NB15 and STIN datasets. The RF-SFS feature selection technique is utilized to improve the classification results and reduce the execution time. The proposed models ensure their efficiency when compared to the literature's existing models [5‐18]. When applied to the UNSW-NB15 dataset, SFS-RF and RF-SFS-GRU approaches achieved high accuracy scores of 78.52% and 79%, respectively, rather than the proposed approach in [18], which achieves accuracy scores in the ANN and KNN approaches of 72.30% and 77.51%, respectively, when using 19 features. In the STIN dataset, SFS-RF and RF-SFS-GRU achieved high accuracy results of 90.5% and 87%, respectively. The proposed approaches achieved high accuracy in Syn_DDos attacks compared to [5], but the RFMLP model [5] achieved high accuracy in UDP_DDos attacks compared to the proposed approaches. In the future, a new dataset with more various types of satellite attacks and normal traffic will be constructed to test the efficiency of the proposed models.