Intrusion Detection with Set-Valued Classification: Leveraging Dempster-Shafer Theory and Deep Learning

Intrusion Detection Systems (IDS) are fundamental in fortifying computer networks against security threats. While numerous neural network classifiers have been developed for multi-class intrusion detection, conventional hard partitioning of feature spaces frequently lead to misclassification, particularly near decision boundaries, causing ambiguity. To address these challenges, we propose an innovative evidential classifier that combines deep learning and the Dempster–Shafer (DS) theory for enhanced network intrusion detection. Our classifier consists of three key components: a feature extractor, a D-S theory-based layer, and an expected utility layer, leveraging Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), and Long Short-Term Memory Networks (LSTM) as feature extractors. The novel approach embraces set-valued classification, where the classifier’s output represents a subset of all possible labels, effectively handling imprecision and ambiguity. We evaluate the performance of our evidential classifier using the NSL-KDD and UNSW-NB15 datasets, demonstrating its proficiency in making cautious decisions. It excels in assigning complex samples to multi-class sets while maintaining high overall accuracy. These results highlight the potential of the evidential deep learning classifier in addressing imprecise intrusion detection challenges, promising a more robust defense against network threats.