A Design of Network Attack Detection Using Causal and Non-causal Temporal Convolutional Network

Temporal Convolution Network(TCN) has recently been introduced in the cybersecurity field, where two types of TCNs that consider causal relationships are used: causal TCN and non-causal TCN. Previous researchers have utilized causal and non-causal TCNs separately. Causal TCN can predict real-time outcomes, but it ignores traffic data from the time when the detection is activated. Non-causal TCNs can forecast results more globally, but they are less real-time. Employing either causal TCN or non-causal TCN individually has its drawbacks, and overcoming these shortcomings has become an important topic. In this research, we propose a method that combines causal and non-causal TCN in a contingent form to improve detection accuracy, maintain real-time performance, and prevent long detection time. Additionally, we use two datasets to evaluate the performance of the proposed method: NSL-KDD, a well-known dataset for evaluating network intrusion detection systems, and MQTT-IoT-2020, which simulates the MQTT protocol, a standard protocol for IoT machine-to-machine communication. The proposed method in this research increased the detection time by about 0.1ms compared to non-causal TCN when using NSL-KDD, but the accuracy improved by about 1.5%, and the recall improved by about 4%. For MQTT-IoT-2020, the accuracy improved by about 3%, and the recall improved by about 7% compared to causal TCN, but the accuracy decreased by about 1% compared to non-causal TCN. The required time was shortened by 30ms (around 30%), and the recall was improved by about 7%.