仅用正常数据训练，就能检测未知网络攻击。
Learning to Detect Cyber Attacks: Neural Anomaly Detection for Cybersecurity with Theoretical Insights
- 用正常样本加合成异常样本来训练神经网络
- 能准确学习正常数据边界，检测未知攻击
- 适合真实攻击样本难获取的场景
在网络安全实践中，新型网络攻击不断涌现，旨在规避依赖历史行为的防御系统。为应对这一挑战，我们提出一种基于神经网络的异常检测方法，无需依赖（1）异常分布的先验知识，也无需在训练中使用真实异常样本。该方法仅使用正常样本进行训练，并结合合成异常样本的监督信号，特别适用于真实异常样本难以获取或成本高昂的场景。所训练的分类器被证明可达到极小化超额风险，更重要的是，能保证学习到正常区域的边界。一旦正常区域被良好估计，模型即可检测各类异常，而无需显式建模异常分布。在网络安全、工业和医疗领域的多组实验表明，该方法在鲁棒性和性能上均优于当前主流基线。特别是在网络入侵检测任务中，相比其他方法，本方法显著提升了对复杂且未见过的攻击的检测能力。
原文摘要 · Abstract (English)
In cybersecurity practice, new forms of cyberattacks continuously emerge, deliberately designed to evade defense systems that rely on previously observed behaviors. Motivated by this challenge, we propose a neural network-based method for anomaly detection that does not rely on (1) prior knowledge of anomaly distributions or (2) the availability of real anomalies during training. Our proposed method trains a neural network classifier using only normal samples, combining the supervision from synthetic anomalies, and is particularly suitable when collecting real anomaly samples is expensive or impractical. The trained classifier is proven to attain minimax excess risk, and more importantly, it is guaranteed to learn the boundary of the normal region. Once the normal region is well estimated, the model can detect a wide range of anomalies without requiring explicit modeling of their distributions. Extensive experiments across cybersecurity, industrial, and medical anomaly detection tasks demonstrate that our method is consistently robust and competitive compared to state-of-the-art baselines. Notably, in the context of network intrusion detection, our approach significantly enhances the detection of difficult and previously unseen cyberattacks compared to other baselines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。