From zero-shot machine learning to zero-day attack detection

Abstract

Machine learning (ML) models have proved efficient in classifying data samples into their respective categories. The standard ML evaluation methodology assumes that test data samples are derived from pre-observed classes used in the training phase. However, in applications such as Network Intrusion Detection Systems (NIDSs), obtaining data samples of all attack classes to be observed is challenging. ML-based NIDSs face new attack traffic known as zero-day attacks that are not used in training due to their non-existence at the time. Therefore, this paper proposes a novel zero-shot learning methodology to evaluate the performance of ML-based NIDSs in recognising zero-day attack scenarios. In the attribute learning stage, the learning models map network data features to semantic attributes that distinguish between known attacks and benign behaviour. In the inference stage, the models construct the relationships between known and zero-day attacks to detect them as malicious. A new evaluation metric is defined as Zero-day Detection Rate (Z-DR) to measure the effectiveness of the learning model in detecting unknown attacks. The proposed framework is evaluated using two key ML models and two modern NIDS data sets. The results demonstrate that for certain zero-day attack groups discovered in this paper, ML-based NIDSs are ineffective in detecting them as malicious. Further analysis shows that attacks with a low Z-DR have a significantly distinct feature distribution and a higher Wasserstein Distance range than the other attack classes.

Social Media Zero-Day Attack Detection Using TensorFlow

“…Further investigation revealed that these assaults with low-zero-day detection percentages have distinctive characteristic distributions and a wider Wasserstein distance than assaults in other assault classes. These results show the need to consider certain feature distributions to overcome such obstacles and illustrate the shortcomings of ML-based IDSs in successfully identifying specific zero-day attack situations [24].…”

“…To evaluate the effectiveness of machine learning-based IDSs in recognizing zeroday attack scenarios, Sarhan et al [24] developed a unique zero-shot learning approach. The learning models translate data characteristics to semantic attributes that distinguish between known attacks and benign activity during the attribute learning step.…”

An Effective Method for Detecting Unknown Types of Attacks Based on Log-Cosh Variational Autoencoder

“…In a similar vein, Kumar, V. developed a two-phase intelligent network technique specifically for identifying zero-day threats, achieving impressive accuracy rates of over 90% on CICIDS 2018 and real-time datasets using created signatures [25]. Sarhan, M. suggested a zero-sample learning technique to evaluate the performance of machine learning-based detection systems against unknown threats, providing valuable insights into their abilities to identify and mitigate such threats [26]. Sheng, C. devised a self-growing attack traffic classification system based on density-based heuristic clustering to improve the detection of unknown forms of attacks, enabling real-time automated detection [27].…”

LoGD-ai: An Efficient Network Intrusion Detection System Using a Soft Voting-Based Ensemble Learner

“…The findings conclude that SVM, scoring an average accuracy of 98.18%, refers to the best machine learning algorithm that can detect intrusions in a system. To empower machine learning-based NIDS to be able to detect zero-day attacks, [7] proposes a zero-shot learning method, which maps network data to known and unknown attack behaviors. Designing zero-day detection rate, the study was able to measure the effectiveness of the ML model developed, using UNSW-NB15 and NF-UNSW-NB15v2 datasets.…”

“…With the widespread usage of Internet applications, numerous network security issues occur on a regular basis, weakening network security. The vulnerabilities in cyberspace have led to various cyber-attacks including unauthorized access, denial of service (DoS), malware attacks, zero-day attacks, data breaches, social engineering, or phishing [5]- [7]. In May 2017, a ransomware virus caused massive losses in several areas, including banking, energy, medical care, and colleges.…”