Abstract:recent years, deep learning-based network intrusion detection systems (IDS) have shown impressive results in detecting attacks. However, most existing IDS can only recognize known attacks that were included in their training data. When faced with unknown attacks, these systems are often unable to take appropriate actions and incorrectly classify them into known categories, leading to reduced detection performance. Furthermore, as the number and types of network attacks continue to increase, it becomes challenging for these IDS to update their model parameters promptly and adapt to new attack scenarios. To address these issues, this paper introduces a dynamic intrusion detection system, Dynamic Unknown Attack Intrusion Detection System (DUA-IDS). This system aims to learn and detect unknown attacks effectively. DUA-IDS comprises three components: Feature Extractor: This component employs CNN and Transformer models to extract data features from various perspectives. Threshold-Based Classifier: The second part utilizes the nearest mean rule of samples to classify known and unknown attacks, enabling the distinction between them. Dynamic Learning Module: The third part incorporates data playback and knowledge distillation techniques to retain existing category knowledge while continuously learning new attack categories. To assess the effectiveness of DUA-IDS, this paper conducted experiments using the UNSW-NB15 public dataset. The experimental results show that DUA-IDS improves the classification accuracy of flow network data with unknown traffic attacks. Can accurately distinguish unknown traffic and correctly classify known traffic. When dynamically learning unknown traffic, the classification accuracy of previously learned known traffic is less affected. This indicates the advantages of DUA-IDS in detecting unknown attacks and learning new attack categories.

New method for intrusion features mining in IDS

Study of Adaptive Intrusion Detection with Data Mining

Research on Data Mining-based Intrusion Detection in Real-time Environment

New algorithm mining intrusion patterns

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

An Intrusion Detection System Based On System Call

Research on Network Intrusion Detection Based on Data Mining

Hybrid Intrusion Detection Based on Data Mining

Applications of data mining to network intrusion detection

Feature selection for intrusion detection systems

Research of Anomaly Detection System Based on Data Mining

An Integrated Feature Extraction Based on Principal Components and Deep Auto Encoder with Extra Tree for Intrusion Detection Systems

Effective Feature Extraction for Intrusion Detection System using Non-negative Matrix Factorization and Univariate analysis

DL-IDS: Extracting Features Using CNN-LSTM Hybrid Network for Intrusion Detection System

From Intrusion Detection to Attacker Attribution: A Comprehensive Survey of Unsupervised Methods

Relevant Feature Selection Model Using Data Mining for Intrusion Detection System

An Explainable Intrusion Detection System Based on Feature Importance

XAI-based Feature Selection for Improved Network Intrusion Detection Systems

An intrusion detection method based on decision tree

An overview of Intrusion Detection within an Information System: The Improvment by Process Mining

A Deep Learning-Based Framework for Feature Extraction and Classification of Intrusion Detection in Networks