Abstract:The network security analyzers use intrusion detection systems (IDSes) to distinguish malicious traffic from benign ones. The deep learning-based IDSes are proposed to auto-extract high-level features and eliminate the time-consuming and costly signature extraction process. However, this new generation of IDSes still suffers from a number of challenges. One of the main issues of an IDS is facing traffic concept drift which manifests itself as new (i.e., zero-day) attacks, in addition to the changing behavior of benign users/applications. Furthermore, a practical DL-based IDS needs to be conformed to a distributed architecture to handle big data challenges. We propose a framework for adapting DL-based models to the changing attack/benign traffic behaviors, considering a more practical scenario (i.e., online adaptable IDSes). This framework employs continual deep anomaly detectors in addition to the federated learning approach to solve the above-mentioned challenges. Furthermore, the proposed framework implements sequential packet labeling for each flow, which provides an attack probability score for the flow by gradually observing each flow packet and updating its estimation. We evaluate the proposed framework by employing different deep models (including CNN-based and LSTM-based) over the CIC-IDS2017 and CSE-CIC-IDS2018 datasets. Through extensive evaluations and experiments, we show that the proposed distributed framework is well adapted to the traffic concept drift. More precisely, our results indicate that the CNN-based models are well suited for continually adapting to the traffic concept drift (i.e., achieving an average detection rate of above 95% while needing just 128 new flows for the updating phase), and the LSTM-based models are a good candidate for sequential packet labeling in practical online IDSes (i.e., detecting intrusions by just observing their first 15 packets).

Enhancing network intrusion detection by lifelong active online learning

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

An Efficient Network Intrusion Detection Approach Based on Deep Learning

Leaky Training: A Robustness Improvement Scheme for Autoencoder Based Network Intrusion Detection System under Online Learning

Using Incremental Learning Method for Adaptive Network Intrusion Detection

A Multi-Agent Adaptive Deep Learning Framework for Online Intrusion Detection

Reinforcement Learning Meets Network Intrusion Detection: A Transferable and Adaptable Framework for Anomaly Behavior Identification

Active Learning for Wireless IoT Intrusion Detection

Adaptive and Lightweight Intrusive Traffic Detection Method Based on Deep Learning under Evolving Network Threats

Learning to Detect: A Data-driven Approach for Network Intrusion Detection

A Deep Random Forest Model on Spark for Network Intrusion Detection

A Comparative Study of Off-Line Deep Learning Based Network Intrusion Detection

Utilizing Deep Learning for Enhancing Network Resilience in Finance

Machine learning to improve the performance of anomaly-based network intrusion detection in big data

Three layer hybrid learning to improve intrusion detection system performance

An Interpretable Federated Learning-based Network Intrusion Detection Framework

An Online Rule Generation Model for Intrusion Detection

A Hybrid Intrusion Detection System Based on Scalable K-Means+ Random Forest and Deep Learning

Deep Adversarial Learning in Intrusion Detection: A Data Augmentation Enhanced Framework

Cyber Situation Awareness with Active Learning for Intrusion Detection

A Deep Learning Model for Network Intrusion Detection with Imbalanced Data