Abstract:recent years, deep learning-based network intrusion detection systems (IDS) have shown impressive results in detecting attacks. However, most existing IDS can only recognize known attacks that were included in their training data. When faced with unknown attacks, these systems are often unable to take appropriate actions and incorrectly classify them into known categories, leading to reduced detection performance. Furthermore, as the number and types of network attacks continue to increase, it becomes challenging for these IDS to update their model parameters promptly and adapt to new attack scenarios. To address these issues, this paper introduces a dynamic intrusion detection system, Dynamic Unknown Attack Intrusion Detection System (DUA-IDS). This system aims to learn and detect unknown attacks effectively. DUA-IDS comprises three components: Feature Extractor: This component employs CNN and Transformer models to extract data features from various perspectives. Threshold-Based Classifier: The second part utilizes the nearest mean rule of samples to classify known and unknown attacks, enabling the distinction between them. Dynamic Learning Module: The third part incorporates data playback and knowledge distillation techniques to retain existing category knowledge while continuously learning new attack categories. To assess the effectiveness of DUA-IDS, this paper conducted experiments using the UNSW-NB15 public dataset. The experimental results show that DUA-IDS improves the classification accuracy of flow network data with unknown traffic attacks. Can accurately distinguish unknown traffic and correctly classify known traffic. When dynamically learning unknown traffic, the classification accuracy of previously learned known traffic is less affected. This indicates the advantages of DUA-IDS in detecting unknown attacks and learning new attack categories.

A DNS-based Data Exfiltration Traffic Detection Method for Unknown Samples

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

A DNS Tunnel Sliding Window Differential Detection Method Based on Normal Distribution Reasonable Range Filtering

DNS covert channel detection method using the LSTM model

Construction of Two Statistical Anomaly Features for Small-Sample APT Attack Traffic Classification

Monitoring Security of Enterprise Hosts via DNS Data Analysis

A comprehensive survey on DNS tunnel detection

: Towards Fine-Grained Unknown Class Detection Against the Open-Set Attack Spectrum with Variable Legitimate Traffic

Identifying DNS-tunneled traffic with predictive models

[Treatment of venous thromboembolism in pregnancy with low molecular weight heparin].

HTTPSmell: A Deep Learning Approach on Malicious HTTP Traffic Detection via Data Augmentation and Label Refactoring

Fingerprinting Internet DNS Amplification DDoS Activities

Information-Based Heavy Hitters for Real-Time DNS Data Exfiltration Detection and Prevention

A Survey on Malicious Domains Detection through DNS Data Analysis

An Analysis of the Use of DNS for Malicious Payload Distribution

A New Multistage Approach to Detect Subtle DDoS Attacks.

HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification

A Practical Machine Learning-Based Framework to Detect DNS Covert Communication in Enterprises

Intelligent model for the detection and classification of encrypted network traffic in cloud infrastructure

Countering DNS Amplification Attacks Based on Analysis of Outgoing Traffic

Reexamining DNS from a Global Recursive Resolver Perspective