An Adaptable Deep Learning-Based Intrusion Detection System to Zero-Day Attacks

Abstract

The intrusion detection system (IDS) is an essential element of security monitoring in computer networks. An IDS distinguishes the malicious traffic from the benign one and determines the attack types targeting the assets of the organization. The main challenge of an IDS is facing new (i.e., zero-day) attacks and separating them from benign traffic and existing types of attacks. Along with the power of the deep learning-based IDSes in auto-extracting high-level features and its independence from the time-consuming and costly signature extraction process, the mentioned challenge still exists in this new generation of IDSes.In this paper, we propose a framework for deep learningbased IDSes addressing new attacks. This framework is the first approach using both deep novelty-based classifiers besides the traditional clustering based on the specialized layer of deep structures, in the security scope. Additionally, we introduce DOC++ as a newer version of DOC as a deep novelty-based classifier. We also employ the Deep Intrusion Detection (DID) framework for the preprocessing phase, which improves the ability of deep learning algorithms to detect content-based attacks. We compare four different algorithms (including DOC, DOC++, OpenMax, and AutoSVM) as the novelty classifier of the framework and use both the CIC-IDS2017 and CSE-CIC-IDS2018 datasets for the evaluation. Our results show that DOC++ is the best implementation of the open set recognition module. Besides, the completeness and homogeneity of the clustering and post-training phase prove that this model is good enough for the supervised labeling and updating phase.

A Multi-Agent Adaptive Deep Learning Framework for Online Intrusion Detection

“…In [4], the authors propose DOC++ as a deep novelty-based classifier to detect not seen traffic (both the zero-day attacks and new benign behaviors). Besides, using a joint deep clustering algorithm, enough pieces of each new novel class evidence are gathered and used in the supervised labeling process and corresponding updating phase.…”

“…In some cases, incrementally training solely on a new set of data samples from unknown traffic might make our model biased towards that new traffic, which will be an instance of catastrophic forgetting. As suggested in [38,4], with the advent of new data, we will constitute a training set that possesses the new data in conjuncture with samples corresponding to the previous attacks and benign flows that the model has been previously trained on. To implement this approach, the collective number of data samples belonging to the previous attacks should be equal to the number of the new attack samples.…”

“…Many studies in the literature apply deep learning methods in offline IDSes [3] [4]. Nevertheless, in this paper, we focus on simultaneously adapting DL-based IDSes for the following three practical challenges of online intrusion detection.…”

Open Set Recognition With Dissimilarity Weight for Unknown Attack Detection

“…More recently, [18] generated an unknown attack through a generative model, allowing data other than normal and known attacks to be detected as unknown attacks. [19] performed classification via OSR and clustering based on classified labels to detect unknown attacks. [20] used the extreme value machine (EVM) to obtain an extreme value distribution, leaving only critical data points, and proposed a fast-learning detection method using these data points.…”