Hunt for Unseen Intrusion: Multi-Head Self-Attention Neural Detector

Abstract

A network intrusion detection (NID) system plays a critical role in cybersecurity. However, the existing machine learning-based NID research has a vital issue that their experimental settings do not reflect real-world situations where unknown attacks are constantly emerging. In particular, their train and test sets are from a single data set, which inevitably overestimates the detection power since all test attack types are known in training, and test cases will have similar characteristics to the training data. This paper introduces a new strategy to constitute test data with updated traffic with attack types not included in training data. In the proposed setting, the prediction accuracy of the existing detectors is dropped by about 20% compared to what has been reported. Also, in-depth analysis of detection performance by attack types has revealed that the existing models have strength at certain attack types but struggle to detect the other attack types such as DoS, DDoS, web attack, and port scan. To overcome the issues, we propose a new neural detector, called MHSA, based on a multi-head self-attention mechanism whose architecture suits better to capture scattered pieces of evidence in network traffic. Our model improved the overall detection performance by 29% in false positive rate at the true positive rate of 0.9 and by 9% in AUC over the current state-of-the-art models, successfully detecting the attacks that are not well captured before. Furthermore, we show that our proposed MHSA model even outperforms the best ensemble detector constructed by joining the state-of-the-art classifiers.

Imperative Node Evaluator With Self Replication Mode for Network Intrusion Detection

“…Their overestimation of detection capacity can be traced back to the fact that all test attack types are known in training and therefore test cases would share features with the training data. Seo et al [13] presented a novel approach to populating test data with fresh, up-to-date traffic that includes novel attack types not present in training data. The prediction accuracy of existing detectors is reduced by around 20% in the suggested environment, relative to what has been published.…”

“…There are a wide variety of dangers and methods of attack against computers and networks [12], and this is only expected to increase as management information systems become more sophisticated and widespread. As the number of attacks and vulnerabilities increases, and as misuse detection functions are unable to identify attacks for which no signatures exist yet, researchers are urged to advocate for an intrusion detection mechanism that is capable of identifying novel attacks through anomaly detection models [13]. An ID creates a standard for typical behavior and flag anything that deviates significantly from that as suspicious [14].…”

Turning the Hunted into the Hunter via Threat Hunting: Life Cycle, Ecosystem, Challenges and the Great Promise of AI

“…Since they have used one data set for training and testing, the discovery influence is overestimated because all test attack types are identified in training, while the test cases will be alike to the training data. The paper presents a novel method to create test data with updated traffic with attacks types not found in training data [217].…”