Abstract:recent years, deep learning-based network intrusion detection systems (IDS) have shown impressive results in detecting attacks. However, most existing IDS can only recognize known attacks that were included in their training data. When faced with unknown attacks, these systems are often unable to take appropriate actions and incorrectly classify them into known categories, leading to reduced detection performance. Furthermore, as the number and types of network attacks continue to increase, it becomes challenging for these IDS to update their model parameters promptly and adapt to new attack scenarios. To address these issues, this paper introduces a dynamic intrusion detection system, Dynamic Unknown Attack Intrusion Detection System (DUA-IDS). This system aims to learn and detect unknown attacks effectively. DUA-IDS comprises three components: Feature Extractor: This component employs CNN and Transformer models to extract data features from various perspectives. Threshold-Based Classifier: The second part utilizes the nearest mean rule of samples to classify known and unknown attacks, enabling the distinction between them. Dynamic Learning Module: The third part incorporates data playback and knowledge distillation techniques to retain existing category knowledge while continuously learning new attack categories. To assess the effectiveness of DUA-IDS, this paper conducted experiments using the UNSW-NB15 public dataset. The experimental results show that DUA-IDS improves the classification accuracy of flow network data with unknown traffic attacks. Can accurately distinguish unknown traffic and correctly classify known traffic. When dynamically learning unknown traffic, the classification accuracy of previously learned known traffic is less affected. This indicates the advantages of DUA-IDS in detecting unknown attacks and learning new attack categories.

P-DNN: an Effective Intrusion Detection Method Based on Pruning Deep Neural Network.

NIDS: Neural Network Based Intrusion Detection System

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

Network Anomaly Intrusion Detection Based on Deep Learning Approach

An Intrusion Detection System Using a Deep Neural Network with Gated Recurrent Units.

A Novel Preprocessing Methodology for DNN-Based Intrusion Detection

Strengthening Network Security: Deep Learning Models for Intrusion Detection with Optimized Feature Subset and Effective Imbalance Handling

Malicious Network Traffic Detection Based on Deep Neural Networks and Association Analysis

A Network Traffic Intrusion Detection Method for Industrial Control Systems Based on Deep Learning

Network Intrusion Detection Methods Based on Deep Learning

DualNet: Locate Then Detect Effective Payload with Deep Attention Network

A Deep Learning Model for Network Intrusion Detection with Imbalanced Data

NetNN: Neural Intrusion Detection System in Programmable Networks

Network intrusion detection based on IE-DBN model

Intrusion Detection System Using Voting-Based Neural Network

Deep Neural Network Based Real-Time Intrusion Detection System

A Real Time Deep Learning based Approach for Detecting Network Attacks

An Intrusion Detection Algorithm for DDoS Attacks Based on DBN and Three-way Decisions

A Novel Intrusion Detection Method Based on Lightweight Neural Network for Internet of Things

DeepRoughNetID: A Robust Framework for Network Anomaly Intrusion Detection with High Detection Rates

An efficient deep recurrent neural network for detection of cyberattacks in realistic IoT environment