Abstract:recent years, deep learning-based network intrusion detection systems (IDS) have shown impressive results in detecting attacks. However, most existing IDS can only recognize known attacks that were included in their training data. When faced with unknown attacks, these systems are often unable to take appropriate actions and incorrectly classify them into known categories, leading to reduced detection performance. Furthermore, as the number and types of network attacks continue to increase, it becomes challenging for these IDS to update their model parameters promptly and adapt to new attack scenarios. To address these issues, this paper introduces a dynamic intrusion detection system, Dynamic Unknown Attack Intrusion Detection System (DUA-IDS). This system aims to learn and detect unknown attacks effectively. DUA-IDS comprises three components: Feature Extractor: This component employs CNN and Transformer models to extract data features from various perspectives. Threshold-Based Classifier: The second part utilizes the nearest mean rule of samples to classify known and unknown attacks, enabling the distinction between them. Dynamic Learning Module: The third part incorporates data playback and knowledge distillation techniques to retain existing category knowledge while continuously learning new attack categories. To assess the effectiveness of DUA-IDS, this paper conducted experiments using the UNSW-NB15 public dataset. The experimental results show that DUA-IDS improves the classification accuracy of flow network data with unknown traffic attacks. Can accurately distinguish unknown traffic and correctly classify known traffic. When dynamically learning unknown traffic, the classification accuracy of previously learned known traffic is less affected. This indicates the advantages of DUA-IDS in detecting unknown attacks and learning new attack categories.

Detecting Distributed Denial of Service Attack Based on Multi-feature Fusion.

DM-CIFA: Detection and Mitigation of Collusion Interesting Flooding Attacks in NDNs

Combining cross-correlation and fuzzy classification to detect distributed denial-of-service attacks

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

DDoS Attack Detection Method Based on Network Abnormal Behavior in Big Data Environment

A feature selection-based method for DDoS attack flow classification

A Flow is a Stream of Packets: A Stream-Structured Data Approach for DDoS Detection

A Lightweight Ddos Flooding Attack Detection Algorithm Based On Synchronous Long Flows

MFFLR-DDoS: An encrypted LR-DDoS attack detection method based on multi-granularity feature fusions in SDN

DDoS attack detection method based on conditional random field with feature set

A New Multistage Approach to Detect Subtle DDoS Attacks.

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

Towards Scalable and Robust Distributed Intrusion Alert Fusion with Good Load Balancing.

Towards Real-Time ML-based DDoS Detection Via Cost-Efficient Window-Based Feature Extraction

Towards Detecting Flooding DDOS Attacks Over Software Defined Networks Using Machine Learning Techniques

Exploiting Artificial Immune systems to detect unknown DoS attacks in real-time

DDoS attack detection method based on feature extraction of deep belief network

3D-IDS: Doubly Disentangled Dynamic Intrusion Detection

DDOS Multivariate Information Fusion Model Based on Hierarchical Representation Learning