Abstract:The network security analyzers use intrusion detection systems (IDSes) to distinguish malicious traffic from benign ones. The deep learning-based IDSes are proposed to auto-extract high-level features and eliminate the time-consuming and costly signature extraction process. However, this new generation of IDSes still suffers from a number of challenges. One of the main issues of an IDS is facing traffic concept drift which manifests itself as new (i.e., zero-day) attacks, in addition to the changing behavior of benign users/applications. Furthermore, a practical DL-based IDS needs to be conformed to a distributed architecture to handle big data challenges. We propose a framework for adapting DL-based models to the changing attack/benign traffic behaviors, considering a more practical scenario (i.e., online adaptable IDSes). This framework employs continual deep anomaly detectors in addition to the federated learning approach to solve the above-mentioned challenges. Furthermore, the proposed framework implements sequential packet labeling for each flow, which provides an attack probability score for the flow by gradually observing each flow packet and updating its estimation. We evaluate the proposed framework by employing different deep models (including CNN-based and LSTM-based) over the CIC-IDS2017 and CSE-CIC-IDS2018 datasets. Through extensive evaluations and experiments, we show that the proposed distributed framework is well adapted to the traffic concept drift. More precisely, our results indicate that the CNN-based models are well suited for continually adapting to the traffic concept drift (i.e., achieving an average detection rate of above 95% while needing just 128 new flows for the updating phase), and the LSTM-based models are a good candidate for sequential packet labeling in practical online IDSes (i.e., detecting intrusions by just observing their first 15 packets).

RIDS: Towards Advanced IDS Via RNN Model and Programmable Switches Co-Designed Approaches

Work-in-Progress: Towards Real-Time IDS Via RNN and Programmable Switches Co-Designed Approach

NIDS: Neural Network Based Intrusion Detection System

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

RNNIDS: Enhancing Network Intrusion Detection Systems through Deep Learning

An Intrusion Detection System Using a Deep Neural Network with Gated Recurrent Units.

RIDE: Real-time Intrusion Detection via Explainable Machine Learning Implemented in a Memristor Hardware Architecture

A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks

ID-RDRL: a deep reinforcement learning-based feature selection intrusion detection model

IRADA: integrated reinforcement learning and deep learning algorithm for attack detection in wireless sensor networks

Intelligent In-Network Attack Detection on Programmable Switches with Soterv2

Learn-IDS: Bridging Gaps between Datasets and Learning-Based Network Intrusion Detection

A Simple Framework to Enhance the Adversarial Robustness of Deep Learning-based Intrusion Detection System

Deep-IDS: A Real-Time Intrusion Detector for IoT Nodes Using Deep Learning

IDS with deep learning techniques

C-RADAR: A Centralized Deep Learning System for Intrusion Detection in Software Defined Networks

NetNN: Neural Intrusion Detection System in Programmable Networks

Deep Neural Network Based Real-Time Intrusion Detection System

Juggler-ResNet: A Flexible and High-Speed ResNet Optimization Method for Intrusion Detection System in Software-Defined Industrial Networks

A Multi-Agent Adaptive Deep Learning Framework for Online Intrusion Detection

Network Anomaly Intrusion Detection Based on Deep Learning Approach