Inductive and Transductive Transfer Learning for Zero-day Attack Detection

Abstract

Upon application of supervised machine learning techniques Intrusion Detection Systems (IDSs) are successful in detecting known attacks as they use predefined attack signatures. However, detecting zero-day attacks is challenged because of the scarcity of the labeled instances for zero-day attacks. Advanced research on IDS applies the concept of Transfer Learning (TL) to compensate the scarcity of labeled instances of zero-day attacks by making use of abundant labeled instances present in related domain(s). This paper explores the potential of Inductive and Transductive transfer learning for detecting zero-day attacks experimentally, where inductive TL deals with the presence of minimal labeled instances in the target domain and transductive TL deals with the complete absence of labeled instances in the target domain. The concept of domain adaptation with manifold alignment (DAMA) is applied in inductive TL where the variant of DAMA is proposed to handle transductive TL due to non-availability of labeled instances. NSL_KDD dataset is used for experimentation

Efficient Inductive Transfer Learning based Framework for Zero-Day Attack Detection

“…Sameera et al [14] applied TL to intrusion detection systems (IDS) to detect zero-day attacks and minimize the false positive rate (FPR). They specifically focused on detecting R2L ("Remote-To-Local") attacks and designed a system to detect unlabeled R2L attacks within the dataset of NSL-KDD.…”