Abstract:recent years, deep learning-based network intrusion detection systems (IDS) have shown impressive results in detecting attacks. However, most existing IDS can only recognize known attacks that were included in their training data. When faced with unknown attacks, these systems are often unable to take appropriate actions and incorrectly classify them into known categories, leading to reduced detection performance. Furthermore, as the number and types of network attacks continue to increase, it becomes challenging for these IDS to update their model parameters promptly and adapt to new attack scenarios. To address these issues, this paper introduces a dynamic intrusion detection system, Dynamic Unknown Attack Intrusion Detection System (DUA-IDS). This system aims to learn and detect unknown attacks effectively. DUA-IDS comprises three components: Feature Extractor: This component employs CNN and Transformer models to extract data features from various perspectives. Threshold-Based Classifier: The second part utilizes the nearest mean rule of samples to classify known and unknown attacks, enabling the distinction between them. Dynamic Learning Module: The third part incorporates data playback and knowledge distillation techniques to retain existing category knowledge while continuously learning new attack categories. To assess the effectiveness of DUA-IDS, this paper conducted experiments using the UNSW-NB15 public dataset. The experimental results show that DUA-IDS improves the classification accuracy of flow network data with unknown traffic attacks. Can accurately distinguish unknown traffic and correctly classify known traffic. When dynamically learning unknown traffic, the classification accuracy of previously learned known traffic is less affected. This indicates the advantages of DUA-IDS in detecting unknown attacks and learning new attack categories.

A Hierarchical CNN-Transformer Model for Network Intrusion Detection

CBF-IDS: Addressing Class Imbalance Using CNN-BiLSTM with Focal Loss in Network Intrusion Detection System

Fusion of transformer and ML-CNN-BiLSTM for network intrusion detection

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

A novel multi-scale network intrusion detection model with transformer

An Industrial Intrusion Detection Method Based on Hybrid Convolutional Neural Networks with Improved TCN

CANET: A hierarchical CNN-Attention model for Network Intrusion Detection

An Intrusion Detection Model Based on Feature Reduction and Convolutional Neural Networks

DL-IDS: Extracting Features Using CNN-LSTM Hybrid Network for Intrusion Detection System

Network Intrusion Detection Combined Hybrid Sampling With Deep Hierarchical Network

Network Anomaly Intrusion Detection Based on Deep Learning Approach

1D CNN Based Network Intrusion Detection with Normalization on Imbalanced Data

HDCBAN: Hybrid Neural Network for Network Intrusion Detection System

A CNN-transformer hybrid approach for an intrusion detection system in advanced metering infrastructure

Network Intrusion Detection Method Based on CNN-BiLSTM-Attention Model

A Network Traffic Intrusion Detection Method for Industrial Control Systems Based on Deep Learning

A novel hierarchical attention-based triplet network with unsupervised domain adaptation for network intrusion detection

A Real-time Intrusion Detection Method for Industrial Control Network Based on Heterogeneous Feature Extractor

Network Intrusion Detection Model Based on CNN and GRU

An innovative network intrusion detection system (NIDS): Hierarchical deep learning model based on Unsw-Nb15 dataset