Abstract:recent years, deep learning-based network intrusion detection systems (IDS) have shown impressive results in detecting attacks. However, most existing IDS can only recognize known attacks that were included in their training data. When faced with unknown attacks, these systems are often unable to take appropriate actions and incorrectly classify them into known categories, leading to reduced detection performance. Furthermore, as the number and types of network attacks continue to increase, it becomes challenging for these IDS to update their model parameters promptly and adapt to new attack scenarios. To address these issues, this paper introduces a dynamic intrusion detection system, Dynamic Unknown Attack Intrusion Detection System (DUA-IDS). This system aims to learn and detect unknown attacks effectively. DUA-IDS comprises three components: Feature Extractor: This component employs CNN and Transformer models to extract data features from various perspectives. Threshold-Based Classifier: The second part utilizes the nearest mean rule of samples to classify known and unknown attacks, enabling the distinction between them. Dynamic Learning Module: The third part incorporates data playback and knowledge distillation techniques to retain existing category knowledge while continuously learning new attack categories. To assess the effectiveness of DUA-IDS, this paper conducted experiments using the UNSW-NB15 public dataset. The experimental results show that DUA-IDS improves the classification accuracy of flow network data with unknown traffic attacks. Can accurately distinguish unknown traffic and correctly classify known traffic. When dynamically learning unknown traffic, the classification accuracy of previously learned known traffic is less affected. This indicates the advantages of DUA-IDS in detecting unknown attacks and learning new attack categories.

i dfa: A novel deterministic finite automaton without state explosion

TFA : A Tunable Finite Automaton for Regular Expression Matching

TFA: A Tunable Finite Automaton for Pattern Matching in Network Intrusion Detection Systems.

StriFA: Stride Finite Automata for High-Speed Regular Expression Matching in Network Intrusion Detection Systems

Deflation Dfa: Remembering History Is Adequate

Pattern-Based DFA for Memory-Efficient and Scalable Multiple Regular Expression Matching.

Cache-Based Scalable Deep Packet Inspection with Predictive Automaton.

State Encoding for Multi-Pattern Matching for Network Intrusion Detection

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

A Technical Survey on Intelligent Optimization Grouping Algorithms for Finite State Automata in Deep Packet Inspection

Managing DFA History with Queue for Deflation DFA

Reorganized and Compact DFA for Efficient Regular Expression Matching

A technical research survey on bio-inspired intelligent optimization grouping algorithms for finite state automata in intrusion detection system

Fast Practical Compression of Deterministic Finite Automata

Parallel Architecture for High Throughput DFA-Based Deep Packet Inspection

Network Intrusion Detection System in Latest DFA Compression Methods for Deep Packet Scruting

Parallel Dfa Architecture For Ultra High Throughput Dfa-Based Pattern Matching

Independent Parallel Compact Finite Automatons for Accelerating Multi-String Matching

Step-FA: Step-Based Compact Finite Automaton for Accelerating Multi-String Matching

StriD²FA: Scalable Regular Expression Matching for Deep Packet Inspection

DeepDFA: Automata Learning through Neural Probabilistic Relaxations