AA-HMM: An Anti-Adversarial Hidden Markov Model for Network-Based Intrusion Detection

Abstract

In the field of network intrusion, malware usually evades anomaly detection by disguising malicious behavior as legitimate access. Therefore, detecting these attacks from network traffic has become a challenge in this an adversarial setting. In this paper, an enhanced Hidden Markov Model, called the Anti-Adversarial Hidden Markov Model (AA-HMM), is proposed to effectively detect evasion pattern, using the Dynamic Window and Threshold techniques to achieve adaptive, anti-adversarial, and online-learning abilities. In addition, a concept called Pattern Entropy is defined and acts as the foundation of AA-HMM. We evaluate the effectiveness of our approach employing two well-known benchmark data sets, NSL-KDD and CTU-13, in terms of the common performance metrics and the algorithm’s adaptation and anti-adversary abilities.

Intrusion Detection Using Normalized Mutual Information Feature Selection and Parallel Quantum Genetic Algorithm

“…The K -means (Alyaseen et al, 2017), the AE -CGAN -RF (Jiadong et al, 2019), AA -HMM (Song et al, 2018), MDPCA-DBN (Yang et al, 2019), GA (Ying-Wu et al, 2010), and the NMIFS MOP -AQGA algorithm proposed in this paper are used to train and test with experimental data set. The ROC curves on five kinds of data set are shown in Figure 4.…”

“…They used the Modified Density Peak Clustering Algorithm and Deep Networks to reduce the size of the training set, solve the imbalance of sample, and improve the efficiency of detection. Song et al (2018) proposed an anti-adversarial hidden markov model for network-based intrusion detection (AA-HMM). However those algorithms had lower self-adaptability, lower detection rate, and higher false alert rate for small samples sets.…”

An Intrusion Detection System Based on Normalized Mutual Information Antibodies Feature Selection and Adaptive Quantum Artificial Immune System

“…Yang et al (2019) proposed an effective IDS using the Modified Density Peak Clustering Algorithm and Deep Belief Networks (MDPCA-DBN); they used the MDPCA and A-DBN to reduce the size of the training set, solve the imbalance of samples, and therefore improve the detection efficiency. Song et al (2018) proposed an anti-adversarial hidden Markov model for network-based intrusion detection (AA-HMM). Ehsan et al (2021) proposed a new complex mixed artificial immune intrusion detection system; the system integrated the negative selection algorithm (NSA) and the DCA for detectors.…”