Abstract:Since its inception, the Internet has been rapidly evolving. With the advancement of science and technology and the explosive growth of the population, the demand for the Internet has been on the rise. Many applications in education, healthcare, entertainment, science, and more are being increasingly deployed based on the internet. Concurrently, malicious threats on the internet are on the rise as well. Distributed Denial of Service (DDoS) attacks are among the most common and dangerous threats on the internet today. The scale and complexity of DDoS attacks are constantly growing. Intrusion Detection Systems (IDS) have been deployed and have demonstrated their effectiveness in defense against those threats. In addition, the research of Machine Learning (ML) and Deep Learning (DL) in IDS has gained effective results and significant attention. However, one of the challenges when applying ML and DL techniques in intrusion detection is the identification of unknown attacks. These attacks, which are not encountered during the system’s training, can lead to misclassification with significant errors. In this research, we focused on addressing the issue of Unknown Attack Detection, combining two methods: Spatial Location Constraint Prototype Loss (SLCPL) and Fuzzy C-Means (FCM). With the proposed method, we achieved promising results compared to traditional methods. The proposed method demonstrates a very high accuracy of up to 99.8% with a low false positive rate for known attacks on the Intrusion Detection Evaluation Dataset (CICIDS2017) dataset. Particularly, the accuracy is also very high, reaching 99.7%, and the precision goes up to 99.9% for unknown DDoS attacks on the DDoS Evaluation Dataset (CICDDoS2019) dataset. The success of the proposed method is due to the combination of SLCPL, an advanced Open-Set Recognition (OSR) technique, and FCM, a traditional yet highly applicable clustering technique. This has yielded a novel method in the field of unknown attack detection. This further expands the trend of applying DL and ML techniques in the development of intrusion detection systems and cybersecurity. Finally, implementing the proposed method in real-world systems can enhance the security capabilities against increasingly complex threats on computer networks.

Network Anomaly Detection Based on DSOM and ACO Clustering

Packet Payload Based Anomalous Network Intrusion Detection

An Industrial Network Intrusion Detection Algorithm Based on Multifeature Data Clustering Optimization Model

Distributed Online One-Class Support Vector Machine for Anomaly Detection over Networks

A hybrid unsupervised clustering-based anomaly detection method

CLUSTERING-BASED NETWORK INTRUSION DETECTION

Anomaly-Based Intrusion Detection System using Supervised Learning Algorithm Artificial Neural Network and Ant Colony Optimization with Feature Selection

An Exhaustive Research on the Application of Intrusion Detection Technology in Computer Network Security in Sensor Networks

A Hybrid Spectral Clustering and Deep Neural Network Ensemble Algorithm for Intrusion Detection in Sensor Networks

An Effective Method for Computer Network Anomaly Detection

Kohonen neural network and symbiotic-organism search algorithm for intrusion detection of network viruses

A DATA ANALYZER IN NETWORK ANOMALY DETECTION SYSTEM BASED ON HIERARCHICAL SELF-ORGANIZING MAP

Multiresolution dendritic cell algorithm for network anomaly detection

A Novel Backbone Network Anomaly Detector Via Clustering In Sketch Space

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

High-speed anomaly traffic detection based on staged frequency domain features

Unknown DDoS Attack Detection with Fuzzy C-Means Clustering and Spatial Location Constraint Prototype Loss

A Distributed Anomaly Detection Scheme Based on Correlation Awareness in WSN

A Modified Hybrid Method Based on PSO, GA, and K-Means for Network Anomaly Detection

Anomaly Intrusion Detection Based on Data Stream

GSOOA-1DDRSN: Network traffic anomaly detection based on deep residual shrinkage networks