Unknown Security Attack Detection Using Shallow and Deep ANN Classifiers

Abstract

Advancements in machine learning and artificial intelligence have been widely utilised in the security domain, including but not limited to intrusion detection techniques. With the large training datasets of modern traffic, intelligent algorithms and powerful machine learning tools, security researchers have been able to greatly improve on the intrusion detection models and enhance their ability to detect malicious traffic more accurately. Nonetheless, the problem of detecting completely unknown security attacks is still an open area of research. The enormous number of newly developed attacks constitutes an eccentric challenge for all types of intrusion detection systems. Additionally, the lack of a standard definition of what constitutes an unknown security attack in the literature and the industry alike adds to the problem. In this paper, the researchers reviewed the studies on detecting unknown attacks over the past 10 years and found that they tended to use inconsistent definitions. This formulates the need for a standard consistent definition to have comparable results. The researchers proposed a new categorisation of two types of unknown attacks, namely Type-A, which represents a completely new category of unknown attacks, and Type-B, which represents unknown attacks within already known categories of attacks. The researchers conducted several experiments and evaluated modern intrusion detection systems based on shallow and deep artificial neural network models and their ability to detect Type-A and Type-B attacks using two well-known benchmark datasets for network intrusion detection. The research problem was studied as both a binary and multi-class classification problem. The results showed that the evaluated models had poor overall generalisation error measures, where the classification error rate in detecting several types of unknown attacks from 92 experiments was 50.09%, which highlights the need for new approaches and techniques to address this problem.

Comparing Machine Learning Classifiers for Continuous Authentication on Mobile Devices by Keystroke Dynamics

“…Representativity of the sessions is also a limitation since the creators of the HMOG dataset designed these to represent everyday interactions. Research on attack detection shows that unknown attacks are difficult to learn from [35], and as CA usually models impostors as the action of others, CA systems may respond poorly to new attack vectors. Several studies also analyzed the environmental conditions of the interaction, such as posture (e.g., walking, sitting), which our study did not address.…”

Design and Implementation of an Anomaly Network Traffic Detection Model Integrating Temporal and Spatial Features

“…Table 1 summarizes the research results of deep learning in the field of anomaly network traffic detection mentioned in this section. Alzewairi et al [34] proposed two new classification methods for unknown attacks. To solve the problems of anomaly network detection and improve accuracy and scalability, Khan et al [35] proposed a new network model based on spark ML and convolutional LSTM.…”

Verification Based Scheme to Restrict IoT Attacks

“…The authors used the relationships between feature space and semantic space, where an average accuracy 88.3% was reported. Another study for UAs detection is proposed in [1], where the authors achieved the overall result of 50% using shallow and deep ANN for unknown attack detection.…”