Abstract:Network Intrusion Detection Systems (NIDS) have been extensively investigated by monitoring real network traffic and analyzing suspicious activities. However, there are limitations in detecting specific types of attacks with NIDS, such as Advanced Persistent Threats (APT). Additionally, NIDS is restricted in observing complete traffic information due to encrypted traffic or a lack of authority. To address these limitations, a Host-based Intrusion Detection system (HIDS) evaluates resources in the host, including logs, files, and folders, to identify APT attacks that routinely inject malicious files into victimized nodes. In this study, a hybrid network intrusion detection system that combines NIDS and HIDS is proposed to improve intrusion detection performance. The feature flattening technique is applied to flatten two-dimensional host-based features into one-dimensional vectors, which can be directly used by traditional Machine Learning (ML) models. A two-stage collaborative classifier is introduced that deploys two levels of ML algorithms to identify network intrusions. In the first stage, a binary classifier is used to detect benign samples. All detected attack types undergo a multi-class classifier to reduce the complexity of the original problem and improve the overall detection performance. The proposed method is shown to generalize across two well-known datasets, CICIDS 2018 and NDSec-1. Performance of XGBoost, which represents conventional ML, is evaluated. Combining host and network features enhances attack detection performance (macro average F1 score) by 8.1% under the CICIDS 2018 dataset and 3.7% under the NDSec-1 dataset. Meanwhile, the two-stage collaborative classifier improves detection performance for most single classes, especially for DoS-LOIC-UDP and DoS-SlowHTTPTest, with improvements of 30.7% and 84.3%, respectively, when compared with the traditional ML XGBoost.

A multi-label network attack detection approach based on two-stage model fusion

Analysis and Detection against Network Attacks in the Overlapping Phenomenon of Behavior Attribute

A Method of Few-Shot Network Intrusion Detection Based on Meta-Learning Framework

Cross-domain network attack detection enabled by heterogeneous transfer learning

Hybrid CNN-LSTM model combined with feature selection and SMOTE for detection of network attacks

A Multi-Channel Contrastive Learning Network Based Intrusion Detection Method

Host-Based Network Intrusion Detection via Feature Flattening and Two-stage Collaborative Classifier

Anomaly based multi-stage attack detection method

MEMBER: A multi-task learning model with hybrid deep features for network intrusion detection

A multimodal hybrid parallel network intrusion detection model

CPS Attack Detection under Limited Local Information in Cyber Security: an Ensemble Multi-Node Multi-Class Classification Approach

Intelligent Advanced Attack Detection Technology based on Multi-modal Data Fusion

SEDAT: A Stacked Ensemble Learning-Based Detection Model for Multiscale Network Attacks

Expanding Analytical Capabilities in Intrusion Detection through Ensemble-Based Multi-Label Classification

Attribution classification method of APT malware based on multi-feature fusion

MAAC: Novel Alert Correlation Method To Detect Multi-step Attack

A Two-Stage Anomaly Detection Method Based on User Preference Features and the Deep Fusion Model

Multi-Label Adversarial Attack Based on Label Correlation

An Unsupervised Two-Layer Multi-Step Network Attack Detector

Showing Many Labels in Multi-label Classification Models: An Empirical Study of Adversarial Examples

ECNet: Robust Malicious Network Traffic Detection With Multi-View Feature and Confidence Mechanism