Abstract:recent years, deep learning-based network intrusion detection systems (IDS) have shown impressive results in detecting attacks. However, most existing IDS can only recognize known attacks that were included in their training data. When faced with unknown attacks, these systems are often unable to take appropriate actions and incorrectly classify them into known categories, leading to reduced detection performance. Furthermore, as the number and types of network attacks continue to increase, it becomes challenging for these IDS to update their model parameters promptly and adapt to new attack scenarios. To address these issues, this paper introduces a dynamic intrusion detection system, Dynamic Unknown Attack Intrusion Detection System (DUA-IDS). This system aims to learn and detect unknown attacks effectively. DUA-IDS comprises three components: Feature Extractor: This component employs CNN and Transformer models to extract data features from various perspectives. Threshold-Based Classifier: The second part utilizes the nearest mean rule of samples to classify known and unknown attacks, enabling the distinction between them. Dynamic Learning Module: The third part incorporates data playback and knowledge distillation techniques to retain existing category knowledge while continuously learning new attack categories. To assess the effectiveness of DUA-IDS, this paper conducted experiments using the UNSW-NB15 public dataset. The experimental results show that DUA-IDS improves the classification accuracy of flow network data with unknown traffic attacks. Can accurately distinguish unknown traffic and correctly classify known traffic. When dynamically learning unknown traffic, the classification accuracy of previously learned known traffic is less affected. This indicates the advantages of DUA-IDS in detecting unknown attacks and learning new attack categories.

Efficient Intrusion Detection Based on Static Analysis and Stack Walks

Static Information Flow Tracking Based Approach to Detect Input Validation Vulnerabilities

Think That Attackers Think: Using First-Order Theory of Mind in Intrusion Response System.

Energy-Efficient Intrusion Detection with a Barrier of Probabilistic Sensors: Global and Local

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

Multi-agent based hybrid Intrusion detection system

Low-cost Intrusion Detection Method Based on Statistical Language Models

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Research on Dynamic Adaptive Intrusion Detection Model

A Control Flow Based Program Behavior Extended Model

A Low-Cost Method to Intrusion Detection System Using Sequences of System Calls

An Intrusion Detection Method for Industrial Control System against Stealthy Attack

A weighted intrusion detection model of dynamic selection

Processing of Massive Audit Data Streams for Real-Time Anomaly Intrusion Detection

An intrusion detection method based on decision tree

StriFA: Stride Finite Automata for High-Speed Regular Expression Matching in Network Intrusion Detection Systems

Spatial-Temporal Moving Target Defense: A Markov Stackelberg Game Model

Modeling program behaviors by hidden Markov models for intrusion detection

A Static Method for Detection of Information Theft Malware

A Hybrid Approach to Detecting Security Defects in Programs

Program Intrusion Detection Based on Simplified Control Flow Monitoring