Model training

As we mentioned earlier in the chapter, we are using LSTM for use case one, an autoencoder for the multilayer IDS dataset, and DNN for the overall IDS dataset. In the following subsections, we will present the DL model-training process for the two use cases.

Use case one

We considered a three-LSTMs-layered network architecture for the CPU utilization based host/device-level intrusion detection. The following diagram presents the LSTM architecture we used:

We can train and test the model by running the lstm_anomaly_detection.py file (available in the chapter's code folder) as follows:

python lstm_anomaly_detection.py 

...