CBAM: A Contextual Model for Network Anomaly Detection

Abstract

Anomaly-based intrusion detection methods aim to combat the increasing rate of zero-day attacks, however, their success is currently restricted to the detection of high-volume attacks using aggregated traffic features. Recent evaluations show that the current anomaly-based network intrusion detection methods fail to reliably detect remote access attacks. These are smaller in volume and often only stand out when compared to their surroundings. Currently, anomaly methods try to detect access attack events mainly as point anomalies and neglect the context they appear in. We present and examine a contextual bidirectional anomaly model (CBAM) based on deep LSTM-networks that is specifically designed to detect such attacks as contextual network anomalies. The model efficiently learns short-term sequential patterns in network flows as conditional event probabilities. Access attacks frequently break these patterns when exploiting vulnerabilities, and can thus be detected as contextual anomalies. We evaluated CBAM on an assembly of three datasets that provide both representative network access attacks, real-life traffic over a long timespan, and traffic from a real-world red-team attack. We contend that this assembly is closer to a potential deployment environment than current NIDS benchmark datasets. We show that, by building a deep model, we are able to reduce the false positive rate to 0.16% while effectively detecting six out of seven access attacks, which is significantly lower than the operational range of other methods. We further demonstrate that short-term flow structures remain stable over long periods of time, making the CBAM robust against concept drift.

Target Detection of Pointer Instrument based on Deep Learning

“…In the field of target detection, the evaluation index [18] in the field of information retrieval is used to evaluate the detection performance of a single category, in which the AP value is the area value under the P-R curve with accuracy and recall as the vertical and horizontal coordinate axis, as shown in formula (7). For the calculation of precision (also known as recall), formula (8) is used.…”

“…In view of the balance between detection accuracy and speed of Yolo series algorithms, yolov3 is selected as the detection basic network to improve the anchor box calculation method, so as to make it more suitable for the anchor boxes of instrument data set and make it more rapid convergence model; In addition, the residual block is added to further improve the extraction of shallow features, and the convolution block attention module CBAM [6][7][8] is added to the backbone network to deduce the attention weight sequentially from the two dimensions of channel and space, and then multiply it with the original feature map for adaptive adjustment, so as to make the network pay more attention to the area where the instrument target is located.…”

LADEMU: a modular & continuous approach for generating labelled APT datasets from emulations

“…[17] -and will instead focus on some more generic observations. The challenges faced when developing suitable datasets, and their scarcity, has already been discussed [9], [20], [30], [36]. A significant number of published works have used old and outdated datasets as benchmarks [8].…”

“…As a result, there has consistently been a lack of suitable datasets for this domain [9], [20], [30], [36] -and even more so for APTs [36] -causing some to argue that lack of suitable datasets constitutes one of the biggest challenges for developing capabilities to defend against APTs [34].…”

Plant and Salamander Inspired Network Attack Detection and Data Recovery Model

“…In the work of Urooj et al [ 10 ], the role of Deep Learning and Machine Learning is discussed both in the performance of the attack and detection of the attack. Henry et al [ 11 ] have demonstrated that using a bidirectional LSTM network, a potential network anomaly could be detected in a short session of time. However, one of the fundamental challenges in the applicability of Machine Learning- (ML) and Deep Learning- (DL) based intrusion detection systems is that most of them are trained using an almost decade-old NSL-KDD dataset.…”