A Survey on Data-Driven Learning for Intelligent Network Intrusion Detection Systems

Abstract

An effective anomaly-based intelligent IDS (AN-Intel-IDS) must detect both known and unknown attacks. Hence, there is a need to train AN-Intel-IDS using dynamically generated, real-time data in an adversarial setting. Unfortunately, the public datasets available to train AN-Intel-IDS are ineluctably static, unrealistic, and prone to obsolescence. Further, the need to protect private data and conceal sensitive data features has limited data sharing, thus encouraging the use of synthetic data for training predictive and intrusion detection models. However, synthetic data can be unrealistic and potentially bias. On the other hand, real-time data are realistic and current; however, it is inherently imbalanced due to the uneven distribution of anomalous and non-anomalous examples. In general, non-anomalous or normal examples are more frequent than anomalous or attack examples, thus leading to skewed distribution. While imbalanced data are commonly predominant in intrusion detection applications, it can lead to inaccurate predictions and degraded performance. Furthermore, the lack of real-time data produces potentially biased models that are less effective in predicting unknown attacks. Therefore, training AN-Intel-IDS using imbalanced and adversarial learning is instrumental to their efficacy and high performance. This paper investigates imbalanced learning and adversarial learning for training AN-Intel-IDS using a qualitative study. It surveys and synthesizes generative-based data augmentation techniques for addressing the uneven data distribution and generative-based adversarial techniques for generating synthetic yet realistic data in an adversarial setting using rapid review, structured reporting, and subgroup analysis.

Joint Semantic Transfer Network for IoT Intrusion Detection

“…However, these methods highly depend on a vast amount of fully labelled data, which is expensive to collect and labourious to annotate. This is particularly difficult for IoT intrusion (II) detection, since data generated by IoT devices usually involves user privacy issues [13], [14], which hinder the publication of IoT intrusion detection data. Besides, these ML models are less capable of handling newly emerged intrusion types due to the shortage of annotated data.…”

Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network

“…This solution not only makes it possible to assess the performance of various IDS implementations against adversarial traffic but also, more important, allows for the improvement of IDS detection by including generated adversarial traffic in the training phase of the IDS. Other research papers are discussing different approaches to use GAN de detect network intrusions [ 15 , 16 , 17 , 18 , 19 , 20 , 21 ]. The principle of the GAN is shown in Figure 1 .…”