A near-autonomous and incremental intrusion detection system through active learning of known and unknown attacks
| Autor: | Gongxuan Zhang, Meziane Yacoub, Samia Bouzefrane, Lynda Boukela |
|---|---|
| Přispěvatelé: | Nanjing University of Science and Technology (NJUST), CEDRIC. Méthodes statistiques de data-mining et apprentissage (CEDRIC - MSDMA), Centre d'études et de recherche en informatique et communications (CEDRIC), Ecole Nationale Supérieure d'Informatique pour l'Industrie et l'Entreprise (ENSIIE)-Conservatoire National des Arts et Métiers [CNAM] (CNAM)-Ecole Nationale Supérieure d'Informatique pour l'Industrie et l'Entreprise (ENSIIE)-Conservatoire National des Arts et Métiers [CNAM] (CNAM), CEDRIC. Réseaux et Objets Connectés (CEDRIC - ROC) |
| Rok vydání: | 2021 |
| Předmět: |
Active learning
Artificial neural network Computer science business.industry Active learning (machine learning) Deep learning Process (computing) Intrusion detection system Machine learning computer.software_genre [INFO.INFO-AI]Computer Science [cs]/Artificial Intelligence [cs.AI] Rendering (computer graphics) Set (abstract data type) [INFO.INFO-CR]Computer Science [cs]/Cryptography and Security [cs.CR] Adaptive system Autonomous IDS Artificial intelligence business computer Incremental learning |
| Zdroj: | SPAC IEEE International Conference on Security, Pattern Analysis, and Cybernetics IEEE International Conference on Security, Pattern Analysis, and Cybernetics, Jun 2021, Chengdu, China. pp.374-379, ⟨10.1109/SPAC53836.2021.9539947⟩ |
| DOI: | 10.1109/spac53836.2021.9539947 |
| Popis: | International audience; Intrusion detection is a traditional practice of security experts, however, there are several issues which still need to be tackled. Therefore, in this paper, after highlighting these issues, we present an architecture for a hybrid Intrusion Detection System (IDS) for an adaptive and incremental detection of both known and unknown attacks. The IDS is composed of supervised and unsupervised modules, namely, a Deep Neural Network (DNN) and the K-Nearest Neighbors (KNN) algorithm, respectively. The proposed system is near-autonomous since the intervention of the expert is minimized through the active learning (AL) approach. A query strategy for the labeling process is presented, it aims at teaching the supervised module to detect unknown attacks and improve the detection of the already-known attacks. This teaching is achieved through sliding windows (SW) in an incremental fashion where the DNN is retrained when the data is available over time, thus rendering the IDS adaptive to cope with the evolutionary aspect of the network traffic. A set of experiments was conducted on the CICIDS2017 dataset in order to evaluate the performance of the IDS, promising results were obtained. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|