Research on Intrusion Detection Model Based on Improved MLP Algorithm

Abstract As hacking techniques have evolved, attackers have increasingly employed botnets to launch large-scale Distributed Denial of Service (DDoS) attacks, where multiple compromised devices collaborate. These devices collectively send a massive number of requests to a target, complicating the identification and mitigation of a single attack source. To address these challenges, Network Intrusion Detection Systems (NIDS) have been introduced to identify malicious traffic. Traditional behavior-based NIDS, however, depend heavily on balanced datasets. Underrepresented samples in the dataset often degrade model performance. Therefore, this paper proposes an improved NIDS based on a modified MLP algorithm. The model can enhance the detection performance of minority classes in imbalanced datasets. The model incorporates the AlexNet module into the MLP algorithm, where AlexNet is an algorithm used for image feature processing. This work reduces the number of convolutional layers and channels, employs smaller convolutional kernels, and reduces the number of neurons in the fully connected layer to tailor the model for intrusion detection. AlexNet extracts features, while SKNets enhance feature representation, and the tuned fully connected layer performs the final classification. Experimental results demonstrate that our MLP-AS algorithm outperforms the MLP algorithm across all seven proposed classification tasks. Notably, BotnetARES and PortScan exhibit significant improvements in f1-score by 18.93\% and 26.57\%, respectively, validating the effectiveness of the algorithmic enhancements.