Abstract:recent years, deep learning-based network intrusion detection systems (IDS) have shown impressive results in detecting attacks. However, most existing IDS can only recognize known attacks that were included in their training data. When faced with unknown attacks, these systems are often unable to take appropriate actions and incorrectly classify them into known categories, leading to reduced detection performance. Furthermore, as the number and types of network attacks continue to increase, it becomes challenging for these IDS to update their model parameters promptly and adapt to new attack scenarios. To address these issues, this paper introduces a dynamic intrusion detection system, Dynamic Unknown Attack Intrusion Detection System (DUA-IDS). This system aims to learn and detect unknown attacks effectively. DUA-IDS comprises three components: Feature Extractor: This component employs CNN and Transformer models to extract data features from various perspectives. Threshold-Based Classifier: The second part utilizes the nearest mean rule of samples to classify known and unknown attacks, enabling the distinction between them. Dynamic Learning Module: The third part incorporates data playback and knowledge distillation techniques to retain existing category knowledge while continuously learning new attack categories. To assess the effectiveness of DUA-IDS, this paper conducted experiments using the UNSW-NB15 public dataset. The experimental results show that DUA-IDS improves the classification accuracy of flow network data with unknown traffic attacks. Can accurately distinguish unknown traffic and correctly classify known traffic. When dynamically learning unknown traffic, the classification accuracy of previously learned known traffic is less affected. This indicates the advantages of DUA-IDS in detecting unknown attacks and learning new attack categories.

Dynamic Model of Non-stationary Behavior and Its Application in Detecting DDoS Attacks

A Novel Model for Detecting Application Layer DDoS Attacks

Hidden Markov Model-Based Attack Detection for Networked Control Systems Subject to Random Packet Dropouts

A Kind of Detecting Model against DDoS Attacks

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

DDoS Attacks Detection Model and Its Application

Detection of Application-Layer DDoS Attack Based on Time Series Analysis

A Model for Detecting Application Layer Flooding Attacks

A New Multistage Approach to Detect Subtle DDoS Attacks.

Group Testing Based Detection of Web Service DDoS Attackers.

Dynamic Entropy Based DoS Attack Detection Method

Analysis and Defense for Application Layer DDoS Attacks in the Novel Network Environment

A Large-Scale Hidden Semi-Markov Model for Anomaly Detection on User Browsing Behaviors

A Detection and Offense Mechanism to Defend Against Application Layer DDoS Attacks

Defending DDoS attacks using hidden Markov models and cooperative reinforcement learning

Mining Web User Behaviors to Detect Application Layer DDoS Attacks

Real-Time Detection of Application-Layer DDoS Attack Using Time Series Analysis

A Method of Run-Time Detecting Ddos Attacks

A Detection Model for Distributed Denial of Service Attacks Based on Network Connection Analysis

An Adaptive Approach for Defending against DDoS Attacks

Method of Detecting Application-Layer DDoS Based on the Out-Linking Behavior of Web Community