Abstract:Network intrusion detection systems (IDSs) based on deep learning have reached fairly accurate attack detection rates. But these deep learning approaches usually have been performed in a closed-set protocol that only known classes appear in training are considered during classification, the existing IDSs will fail to detect the unknown attacks and misclassify them as the training known classes, hence are not scalable. Furthermore, these IDSs are not efficient for updating the deep detection model once new attacks are discovered. To address those problems, we propose a scalable IDS towards detecting, discovering, and learning unknown attacks, it has three components. Firstly, we propose the open-set classification network (OCN) to detect unknown attacks, OCN based on the convolutional neural network adopts the nearest class mean (NCM) classifier, two new loss are designed to jointly optimize it, including Fisher loss and maximum mean discrepancy (MMD) loss. Subsequently, the semantic embedding clustering method is proposed to discover the hidden unknown attacks from all unknown instances detected by OCN. Then we propose the incremental nearest cluster centroid (INCC) method for learning the discovered unknown attacks through updating the NCM classifier. Extensive experiments on KDDCUP'99 dataset and CICIDS2017 dataset indicate that our OCN outperforms the state-of-the-art comparison methods in detecting multiple types of unknown attacks. Our experiments also verify the feasibility of the semantic embedding clustering method and INCC in discovering and learning unknown attacks.

Incremental Semi-Supervised Kernel Construction With Self-Organizing Incremental Neural Network And Application In Intrusion Detection

A Novel Online Incremental Learning Intrusion Prevention System

Application of Supervised SOM Neural Network in Intrusion Detection

Incremental K-Nn SVM Method in Intrusion Detection

ILIDViz: an Incremental Learning-Based Visual Analysis System for Network Anomaly Detection

Semisupervised Incremental Support Vector Machine Learning Based on Neighborhood Kernel Estimation

A New Multi-Level Semi-Supervised Learning Approach for Network Intrusion Detection System Based on the ‘GOA’

Network Intrusion Detection Based on Active Semi-supervised Learning

A near-autonomous and incremental intrusion detection system through active learning of known and unknown attacks

Multilayer Intrusion Detection System Based on Semi-supervised Clustering

Incremental SVM based on reserved set for network intrusion detection

An Incremental Neural Network for Online Supervised Learning and Topology Learning

A Self-Organizing Incremental Neural Network Based on Local Distribution Learning

Multiple kernel learning method for network anomaly detection

A Semi-Supervised Intrusion Detection Algorithm Based on Natural Neighbor

Unsupervised and Semi-supervised Dimensionality Reduction with Self-Organizing Incremental Neural Network and Graph Similarity Constraints.

Network Intrusion Detection Model Based on Improved BYOL Self-Supervised Learning

Network intrusion detection system based on incremental support vector machine

A Scalable Network Intrusion Detection System Towards Detecting, Discovering, and Learning Unknown Attacks

Learning to Detect: A Data-driven Approach for Network Intrusion Detection

An Incremental Local Distribution Network for Unsupervised Learning.