Abstract:recent years, deep learning-based network intrusion detection systems (IDS) have shown impressive results in detecting attacks. However, most existing IDS can only recognize known attacks that were included in their training data. When faced with unknown attacks, these systems are often unable to take appropriate actions and incorrectly classify them into known categories, leading to reduced detection performance. Furthermore, as the number and types of network attacks continue to increase, it becomes challenging for these IDS to update their model parameters promptly and adapt to new attack scenarios. To address these issues, this paper introduces a dynamic intrusion detection system, Dynamic Unknown Attack Intrusion Detection System (DUA-IDS). This system aims to learn and detect unknown attacks effectively. DUA-IDS comprises three components: Feature Extractor: This component employs CNN and Transformer models to extract data features from various perspectives. Threshold-Based Classifier: The second part utilizes the nearest mean rule of samples to classify known and unknown attacks, enabling the distinction between them. Dynamic Learning Module: The third part incorporates data playback and knowledge distillation techniques to retain existing category knowledge while continuously learning new attack categories. To assess the effectiveness of DUA-IDS, this paper conducted experiments using the UNSW-NB15 public dataset. The experimental results show that DUA-IDS improves the classification accuracy of flow network data with unknown traffic attacks. Can accurately distinguish unknown traffic and correctly classify known traffic. When dynamically learning unknown traffic, the classification accuracy of previously learned known traffic is less affected. This indicates the advantages of DUA-IDS in detecting unknown attacks and learning new attack categories.

Predicting intrusion goal using dynamic Bayesian network with transfer probability estimation

Predicting the Intrusion Intentions by Observing System Call Sequences

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

Intrusion Intention Identification Methods Based on Dynamic Bayesian Networks

Intrusion Intention Recognition Method Based on Dynamic Bayesian Networks

Multi-agent based hybrid Intrusion detection system

Plan Recognition Based Method for Predicting Intrusion Intentions of System Call Sequences

An Intrusion Detection System Using a Deep Neural Network with Gated Recurrent Units.

Hybrid bayesian network method for predicting intrusion in reactive intrusion tolerance system

Identifying Intrusion Infections via Probabilistic Inference on Bayesian Network.

Using Case-based Reasoning of Predicting Intrusions for Network Intrusion Detection System

Adjust Fire Goal with UAV Based on Dynamic Bayesian Network

Forecast Of Intrusion Behavior Based On Interactive Knowledge Discovery

Probabilistic Inference Strategy in Distributed Intrusion Detection Systems

Intrusion Prediction with System-Call Sequence-to-Sequence Model.

Novel Intrusion Detection using Probabilistic Neural Network and Adaptive Boosting

Hybrid BP/CNN Neural Network for Intrusion Detection

Using Naive Bayes with AdaBoost to Enhance Network Anomaly Intrusion Detection

Using Network Attack Graph to Predict the Future Attacks

A new intrusion detection approach based on network tomography

Neural Network Based On Dynamic Tunneling Technique For Intrusion Detection