Abstract:recent years, deep learning-based network intrusion detection systems (IDS) have shown impressive results in detecting attacks. However, most existing IDS can only recognize known attacks that were included in their training data. When faced with unknown attacks, these systems are often unable to take appropriate actions and incorrectly classify them into known categories, leading to reduced detection performance. Furthermore, as the number and types of network attacks continue to increase, it becomes challenging for these IDS to update their model parameters promptly and adapt to new attack scenarios. To address these issues, this paper introduces a dynamic intrusion detection system, Dynamic Unknown Attack Intrusion Detection System (DUA-IDS). This system aims to learn and detect unknown attacks effectively. DUA-IDS comprises three components: Feature Extractor: This component employs CNN and Transformer models to extract data features from various perspectives. Threshold-Based Classifier: The second part utilizes the nearest mean rule of samples to classify known and unknown attacks, enabling the distinction between them. Dynamic Learning Module: The third part incorporates data playback and knowledge distillation techniques to retain existing category knowledge while continuously learning new attack categories. To assess the effectiveness of DUA-IDS, this paper conducted experiments using the UNSW-NB15 public dataset. The experimental results show that DUA-IDS improves the classification accuracy of flow network data with unknown traffic attacks. Can accurately distinguish unknown traffic and correctly classify known traffic. When dynamically learning unknown traffic, the classification accuracy of previously learned known traffic is less affected. This indicates the advantages of DUA-IDS in detecting unknown attacks and learning new attack categories.

IntruDTS: Interactive Visual Analysis System for Intrusion Detection in Time Series

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

Data-Driven Intrusion Detection for Intelligent Internet of Vehicles: A Deep Convolutional Neural Network-Based Method

Feature-oriented Design of Visual Analytics System for Interpretable Deep Learning Based Intrusion Detection

ILIDViz: an Incremental Learning-Based Visual Analysis System for Network Anomaly Detection

3D-IDS: Doubly Disentangled Dynamic Intrusion Detection

Inet: Visual Analysis of Irregular Transition in Multivariate Dynamic Networks

IDSRadar:a Real-Time Visualization Framework for IDS Alerts

A Hybrid Visualizing Approach Based on Adaptive Neuro-fuzzy Inference System, Decision Tree, and K-means for Intrusion Detection

Learning to Detect: A Data-driven Approach for Network Intrusion Detection

An Efficient Intrusion Detection Approach for Visual Sensor Networks Based on Traffic Pattern Learning

A Synthetic Visual Analysis System for Time-Varying Network

TSIDS: Spatial–temporal Fusion Gating Multilayer Perceptron for Network Intrusion Detection

Interactive Visual Classification and Analysis on Network Activity

Study on Network Intrusion Detection Based on TSVM

HyIDSVis: Hybrid Intrusion Detection Visualization Analysis Based on Rare Category and Association Rules.

Application and Performance Analysis of Data Preprocessing for Intrusion Detection System.

Detecting Anomalies in Distributed Control Systems by Modeling Traffic Behaviors

Adaptive Intrusion Detection Based on Machine Learning : Feature Extraction , Classifier Construction and Sequential Pattern Prediction

An Explainable Intrusion Detection System Based on Feature Importance

Real-Time Network Intrusion Detection System Based on Deep Learning