提出新方法让入侵检测系统持续适应网络威胁变化。
Continual Learning with Strategic Selection and Forgetting for Network Intrusion Detection
- 根据威胁变化动态选新样本，优先学习漂移模式。
- 检测到重大变化时主动丢弃旧数据，释放内存空间。
- 在两个主流数据集上表现领先，适合实时防御场景。
入侵检测系统（IDS）对保护数字基础设施至关重要。在动态网络环境中，威胁态势和正常行为持续变化，导致概念漂移。尽管持续学习能缓解概念漂移的负面影响，但对漂移模式关注不足以及过度保留过时知识仍会制约IDS的适应能力。本文提出SSF（战略选择与遗忘）方法，一种用于IDS的新型持续学习框架，实现模型的持续更新并保持记忆缓冲区的实时刷新。该方法包含一个战略样本选择算法，优先选取引发‘漂移’模式的新样本，使模型更好理解演进中的威胁环境；同时引入战略遗忘机制，在检测到显著漂移时主动丢弃过时样本，腾出内存以容纳更近期数据。SSF有效捕捉演化模式，确保模型与数据分布变化保持一致，显著提升对概念漂移的适应性。在NSL-KDD和UNSW-NB15数据集上的最先进性能验证了其优越的适应能力。代码已开源：https://github.com/xinchen930/SSF-Strategic-Selection-and-Forgetting。
原文摘要 · Abstract (English)
Intrusion Detection Systems (IDS) are crucial for safeguarding digital infrastructure. In dynamic network environments, both threat landscapes and normal operational behaviors are constantly changing, resulting in concept drift. While continuous learning mitigates the adverse effects of concept drift, insufficient attention to drift patterns and excessive preservation of outdated knowledge can still hinder the IDS's adaptability. In this paper, we propose SSF (Strategic Selection and Forgetting), a novel continual learning method for IDS, providing continuous model updates with a constantly refreshed memory buffer. Our approach features a strategic sample selection algorithm to select representative new samples and a strategic forgetting mechanism to drop outdated samples. The proposed strategic sample selection algorithm prioritizes new samples that cause the `drifted' pattern, enabling the model to better understand the evolving landscape. Additionally, we introduce strategic forgetting upon detecting significant drift by discarding outdated samples to free up memory, allowing the incorporation of more recent data. SSF captures evolving patterns effectively and ensures the model is aligned with the change of data patterns, significantly enhancing the IDS's adaptability to concept drift. The state-of-the-art performance of SSF on NSL-KDD and UNSW-NB15 datasets demonstrates its superior adaptability to concept drift for network intrusion detection. The code is released at https://github.com/xinchen930/SSF-Strategic-Selection-and-Forgetting.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。