自适应在线检测网络异常，误报率低且推理快。
Adaptive NAD: Online and Self-adaptive Unsupervised Network Anomaly Detector
- 两层检测策略生成高可信伪标签
- 误报率最低达0.08%，推理速度超三倍提升
- 适合实时网络安全防护场景
物联网的广泛应用加剧了网络威胁风险，因此开发能适应流量模式演化的异常检测系统至关重要。以往研究多聚焦于离线无监督学习方法，难以应用于实际场景。本文提出 Adaptive NAD，一种面向安全领域的在线自适应无监督网络异常检测框架。采用双层异常检测策略生成高置信度伪标签，并引入新颖的阈值计算技术实现在线更新。实验表明，在 CIC-Darknet2020、NSL-KDD 与 Edge-IIoTset 数据集上，Adaptive NAD 的误报率分别仅为 1.33%、0.71% 和 0.08%，且在线推理延迟比当前最优方案快逾三倍。代码已开源。
原文摘要 · Abstract (English)
The widespread usage of the Internet of Things (IoT) has raised the risks of cyber threats; thus, developing Anomaly Detection Systems (ADSs) that can adapt to evolving traffic pattern is critical. Previous studies primarily focused on offline unsupervised learning methods to safeguard ADSs, which is not applicable in practical real-world applications. In this paper, we design Adaptive NAD, an online and self-Adaptive unsupervised Network Anomaly Detection framework for security domains. A two-layer anomaly detection strategy is proposed to generate reliable high-confidence pseudo-labels. Then, an online training scheme is introduced to update Adaptive NAD by a novel threshold calculation technique. Experimental results demonstrate that Adaptive NAD achieves the lowest false alarm rate (1.33%, 0.71%, and 0.08%) and has a more than 3 times faster online inference latency compared with state-of-the-art solutions on the CIC-Darknet2020, NSL-KDD, and Edge-IIoTset datasets, respectively. The code is released at https://github.com/MyLearnCodeSpace/Adaptive-NAD.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。