{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T08:45:00Z","timestamp":1782981900447,"version":"3.54.5"},"reference-count":24,"publisher":"Springer Science and Business Media LLC","issue":"2","license":[{"start":{"date-parts":[[2022,1,29]],"date-time":"2022-01-29T00:00:00Z","timestamp":1643414400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2022,1,29]],"date-time":"2022-01-29T00:00:00Z","timestamp":1643414400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["SN COMPUT. SCI."],"published-print":{"date-parts":[[2022,3]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>In recent years, due to the rapid growth in network technology, numerous types of intrusions have been uncovered that differ from the existing ones, and the conventional firewalls with specific rule sets and policies are incapable of identifying those intrusions in real-time. Therefore, that demands the requirement of a real-time intrusion detection system (RT-IDS). The ultimate purpose of this research is to construct an RT-IDS capable of identifying intrusions by analysing the inbound and outbound network data in real-time. The proposed system consists of a deep neural network (DNN) trained using 28 features of the NSL-KDD dataset. In addition, it contains the machine learning (ML) pipeline with sequential components for categorical data encoding and feature scaling, which is used before transmitting the real-time data to the trained DNN model to make predictions. Moreover, a real-time feature extractor, which is a C++ program that sniffs data from the real-time network traffic and derives relevant data related to the features of the NSL-KDD dataset using the sniffed data, is deployed between the gateway router and the local area network (LAN). Together with the trained DNN model, the ML pipeline is hosted in a server that can be accessed via a representational state transfer application programming interface (REST API). The DNN has revealed outstanding testing performance results achieving 81%, 96%, 70% and 81% for accuracy, precision, recall and f1-score accordingly. This research comprises a comprehensive technical explanation concerning the implementation and functionality of the complete system. Moreover, leveraging the extensive explanations provided in this paper, advanced IDSs capable of identifying modern intrusions can be constructed.<\/jats:p>","DOI":"10.1007\/s42979-022-01031-1","type":"journal-article","created":{"date-parts":[[2022,1,29]],"date-time":"2022-01-29T10:02:42Z","timestamp":1643450562000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":85,"title":["Deep Neural Network Based Real-Time Intrusion Detection System"],"prefix":"10.1007","volume":"3","author":[{"given":"Sharuka Promodya","family":"Thirimanne","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lasitha","family":"Jayawardana","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9571-6866","authenticated-orcid":false,"given":"Lasith","family":"Yasakethu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Pushpika","family":"Liyanaarachchi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chaminda","family":"Hewage","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2022,1,29]]},"reference":[{"key":"1031_CR1","doi-asserted-by":"publisher","unstructured":"Tavallaee M, Bagheri E, Lu W, Ghorbani AA. A detailed analysis of the KDD CUP 99 data set. In: Proceedings of the 2009 IEEE symposium on computational intelligence in security and defense applications (CISDA), Ottawa, ON, Canada, July 2009. https:\/\/doi.org\/10.1109\/CISDA.2009.5356528.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"1031_CR2","doi-asserted-by":"publisher","unstructured":"Nour M, Jill S. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In: Proceedings of the military communications and information systems conference, Australia, November 2015. https:\/\/doi.org\/10.1109\/MilCIS.2015.7348942.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"1031_CR3","doi-asserted-by":"publisher","unstructured":"Thirimanne S, Jayawardana L, Liyanaarachchi P, Yasakethu L. Comparativqe algorithm analysis for machine learning based intrusion detection system. In: Proceedings of the 10th international conference on information and automation for sustainability (ICIAfS), Negombo, Sri Lanka, August 2021. https:\/\/doi.org\/10.1109\/ICIAfS52090.2021.9605814.","DOI":"10.1109\/ICIAfS52090.2021.9605814"},{"key":"1031_CR4","doi-asserted-by":"publisher","unstructured":"Rajesh T, Deepa P. A survey of intrusion detection models based on NSL-KDD data set. In: Proceedings of the 5th HCT information technology trends (ITT), Dubai, United Arab Emirates, November 2018. https:\/\/doi.org\/10.1109\/CTIT.2018.8649498.","DOI":"10.1109\/CTIT.2018.8649498"},{"key":"1031_CR5","doi-asserted-by":"publisher","unstructured":"Hayoung O, Kijoon C. Real-time intrusion detection system based on self-organized maps and feature correlations. In: Proceedings of the 3rd international conference on convergence and hybrid information technology, Korea (South), November 2008. https:\/\/doi.org\/10.1109\/ICCIT.2008.362.","DOI":"10.1109\/ICCIT.2008.362"},{"key":"1031_CR6","doi-asserted-by":"publisher","unstructured":"Komviriyavut T, Sangkatsanee P, Wattanapongsa-korn N, Charnsripinyo C. Network intrusion detection and classification with Decision Tree and rule based approaches. In: Proceedings of the 9th international symposium on communications and information technology, Korea, September 2009. https:\/\/doi.org\/10.1109\/ISCIT.2009.5341005.","DOI":"10.1109\/ISCIT.2009.5341005"},{"issue":"18","key":"1031_CR7","doi-asserted-by":"publisher","first-page":"2227","DOI":"10.1016\/j.comcom.2011.07.001","volume":"34","author":"P Sangkatsanee","year":"2011","unstructured":"Sangkatsanee P, Wattanapongsakorn N, Charnsripinyo C. Practical real-time intrusion detection using machine learning approaches. Comput Commun. 2011;34(18):2227\u201335. https:\/\/doi.org\/10.1016\/j.comcom.2011.07.001.","journal-title":"Comput Commun"},{"key":"1031_CR8","doi-asserted-by":"publisher","first-page":"7623","DOI":"10.3233\/JIFS-179833","volume":"38","author":"W Hui","year":"2020","unstructured":"Hui W, Zijian C, Bo H. A network intrusion detection system based on convolutional neural network. J Intell Fuzzy Syst. 2020;38:7623\u201337. https:\/\/doi.org\/10.3233\/JIFS-179833.","journal-title":"J Intell Fuzzy Syst"},{"key":"1031_CR9","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/6610675","author":"C Zhang","year":"2021","unstructured":"Zhang C, Chen Y, Meng Y, Ruan F, Chen R, Li Y, Yang Y. A novel framework design of network intrusion detection based on machine learning techniques. Secur Commun Netw. 2021. https:\/\/doi.org\/10.1155\/2021\/6610675.","journal-title":"Secur Commun Netw"},{"key":"1031_CR10","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-019-04152-6","author":"AS Qureshi","year":"2020","unstructured":"Qureshi AS, Khan A, Shamim N, Durad MH. Intrusion detection using deep sparse auto-encoder and self-taught learning. Neural Comput Appl. 2020. https:\/\/doi.org\/10.1007\/s00521-019-04152-6.","journal-title":"Neural Comput Appl"},{"key":"1031_CR11","doi-asserted-by":"publisher","DOI":"10.5120\/ijca2017913992","author":"MR Kabir","year":"2017","unstructured":"Kabir MR, Onik AR, Samad T. A network intrusion detection framework based on bayesian network using wrapper approach. Int J Comput Appl. 2017. https:\/\/doi.org\/10.5120\/ijca2017913992.","journal-title":"Int J Comput Appl"},{"issue":"9","key":"1031_CR12","doi-asserted-by":"publisher","first-page":"1481","DOI":"10.3390\/math8091481","volume":"8","author":"S Jukic","year":"2020","unstructured":"Jukic S, Saracevic M, Subasi A, Kevric J. Comparison of ensemble machine learning methods for automated classification of focal and non-focal epileptic EEG signals. Mathematics. 2020;8(9):1481. https:\/\/doi.org\/10.3390\/math8091481.","journal-title":"Mathematics"},{"key":"1031_CR13","first-page":"1825","volume":"5","author":"H Tang","year":"2009","unstructured":"Tang H, Cao Z. Machine learning-based intrusion detection algorithms. J Comput Inf Syst. 2009;5:1825\u201331.","journal-title":"J Comput Inf Syst"},{"key":"1031_CR14","doi-asserted-by":"publisher","unstructured":"Poonam S, Akansha S. Era of deep neural networks: a review. In: 8th international conference on computing, communication and networking technologies, July 2017. https:\/\/doi.org\/10.1109\/ICCCNT.2017.8203938.","DOI":"10.1109\/ICCCNT.2017.8203938"},{"key":"1031_CR15","unstructured":"Algorithmia. What an ML pipeline is and why it\u2019s important. 2020. https:\/\/algorithmia.com\/blog\/ml-pipeline. Accessed 7 June 2021."},{"issue":"5","key":"1031_CR16","doi-asserted-by":"publisher","first-page":"17","DOI":"10.1109\/MP.2002.1166620","volume":"21","author":"S Ansari","year":"2003","unstructured":"Ansari S, Rajeev S, Chandrashekar H. Packet sniffing: a brief introduction. IEEE Potent. 2003;21(5):17\u20139. https:\/\/doi.org\/10.1109\/MP.2002.1166620.","journal-title":"IEEE Potent"},{"key":"1031_CR17","unstructured":"Scikit-Learn. Sklearn Preprocessing StandardScaler. https:\/\/scikit-learn.org\/stable\/modules\/generated\/sklearn.preprocessing.StandardScaler.html. Accessed 19 July 2021."},{"key":"1031_CR18","unstructured":"Brownlee J. A gentle introduction to the rectified linear unit (ReLU), machine learning mastery. 2019. https:\/\/machinelearningmastery.com\/rectified-linear-activation-function-for-deep-learning-neural-networks. Accessed 3 June 2021."},{"key":"1031_CR19","unstructured":"Katanforoosh K, Kunin D. Initializing neural networks. deeplearning.ai. 2019. https:\/\/www.deeplearning.ai\/ai-notes\/initialization\/#II. Accessed 5 June 2021."},{"key":"1031_CR20","unstructured":"Keras. Layer activation functions. 2021. https:\/\/keras.io\/api\/layers\/activations\/#relu-function. Accessed 19 July 2021."},{"key":"1031_CR21","unstructured":"Keras. Layer weight initializers. 2021. https:\/\/keras.io\/api\/layers\/initializers\/. Accessed 19 July 2021."},{"key":"1031_CR22","unstructured":"Hunt-Walker N. An introduction to the Flask Python web app framework. Opensource. 2018. https:\/\/opensource.com\/article\/18\/4\/flask. Accessed 18 July 2021."},{"key":"1031_CR23","unstructured":"Gunicorn. Gunicorn\u2014WSGI server. https:\/\/docs.gunicorn.org\/en\/stable\/. Accessed 27 July 2021."},{"key":"1031_CR24","doi-asserted-by":"publisher","unstructured":"Yiqun Z, Pengcheng M, Qian G. Multiple classification models based student's phobia prediction study. In: Proceedings of the 3rd IEEE international conference on robotic computing (IRC), February 2019. https:\/\/doi.org\/10.1109\/IRC.2019.00109.","DOI":"10.1109\/IRC.2019.00109"}],"container-title":["SN Computer Science"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s42979-022-01031-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s42979-022-01031-1\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s42979-022-01031-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,3,18]],"date-time":"2022-03-18T11:23:57Z","timestamp":1647602637000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s42979-022-01031-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,1,29]]},"references-count":24,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2022,3]]}},"alternative-id":["1031"],"URL":"https:\/\/doi.org\/10.1007\/s42979-022-01031-1","relation":{},"ISSN":["2662-995X","2661-8907"],"issn-type":[{"value":"2662-995X","type":"print"},{"value":"2661-8907","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,1,29]]},"assertion":[{"value":"31 July 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"10 January 2022","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"29 January 2022","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no conflict of interest. Some of the datasets used and the code generated during the current study are available from the corresponding author on reasonable request.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"145"}}