Abstract:recent years, deep learning-based network intrusion detection systems (IDS) have shown impressive results in detecting attacks. However, most existing IDS can only recognize known attacks that were included in their training data. When faced with unknown attacks, these systems are often unable to take appropriate actions and incorrectly classify them into known categories, leading to reduced detection performance. Furthermore, as the number and types of network attacks continue to increase, it becomes challenging for these IDS to update their model parameters promptly and adapt to new attack scenarios. To address these issues, this paper introduces a dynamic intrusion detection system, Dynamic Unknown Attack Intrusion Detection System (DUA-IDS). This system aims to learn and detect unknown attacks effectively. DUA-IDS comprises three components: Feature Extractor: This component employs CNN and Transformer models to extract data features from various perspectives. Threshold-Based Classifier: The second part utilizes the nearest mean rule of samples to classify known and unknown attacks, enabling the distinction between them. Dynamic Learning Module: The third part incorporates data playback and knowledge distillation techniques to retain existing category knowledge while continuously learning new attack categories. To assess the effectiveness of DUA-IDS, this paper conducted experiments using the UNSW-NB15 public dataset. The experimental results show that DUA-IDS improves the classification accuracy of flow network data with unknown traffic attacks. Can accurately distinguish unknown traffic and correctly classify known traffic. When dynamically learning unknown traffic, the classification accuracy of previously learned known traffic is less affected. This indicates the advantages of DUA-IDS in detecting unknown attacks and learning new attack categories.

Automatic Evasion of Machine Learning-Based Network Intrusion Detection Systems

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

Practical Traffic-space Adversarial Attacks on Learning-based NIDSs.

Adversarial Attacks Against Network Intrusion Detection in IoT Systems

Generative adversarial attacks against intrusion detection systems using active learning

Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors

Adversarial Evasion Attacks Practicality in Networks: Testing the Impact of Dynamic Learning

TAD: Transfer Learning-based Multi-Adversarial Detection of Evasion Attacks against Network Intrusion Detection Systems

An Evasion and Counter-Evasion Study in Malicious Websites Detection

Generating Adversarial Examples Against Machine Learning-Based Intrusion Detector in Industrial Control Systems

Adversarial Attacks Against Deep Learning-Based Network Intrusion Detection Systems and Defense Mechanisms

Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network

A Simple Framework to Enhance the Adversarial Robustness of Deep Learning-based Intrusion Detection System

Adversarial machine learning in Network Intrusion Detection Systems

Explainable and Transferable Adversarial Attack for ML-Based Network Intrusion Detectors

On the Resilience of Machine Learning-Based IDS for Automotive Networks

Detect & Reject for Transferability of Black-box Adversarial Attacks Against Network Intrusion Detection Systems

Modeling Realistic Adversarial Attacks against Network Intrusion Detection Systems

Adversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive Survey

Network Anomaly Intrusion Detection Based on Deep Learning Approach

Intrusion Detection System with Machine Learning and Multiple Datasets