用自监督方法把网络数据变图像，提升未知攻击检测能力
SAFE: Self-Supervised Anomaly Detection Framework for Intrusion Detection
- 将表格型网络数据转为图像格式，用掩码自编码器学习正常行为
- 在CIC-IDS2017数据集上F1分数比SLAD高26.2%，比Anomal-E高23.5%
- 适合需要识别未知攻击的网络安全系统开发者
物联网设备的普及显著增加了网络漏洞，亟需高效的入侵检测系统（IDS）。基于机器学习的入侵检测系统（ML-IDS）虽具备先进检测能力，但依赖标注攻击数据，难以发现未知威胁。自监督学习（SSL）通过仅使用正常数据即可学习模式与异常，展现出巨大潜力。本文提出SAFE框架，将表格型网络入侵数据转换为类图像格式，使掩码自编码器（MAE）能够学习稳健的网络行为表征。提取的特征被输入轻量级新颖性检测器，进一步提升异常检测效果。实验表明，SAFE在F1-score上相比最先进的异常检测方法Scale Learning-based Deep Anomaly Detection（SLAD）最高提升26.2%，相比最先进的基于自监督学习的网络入侵检测方法Anomal-E最高提升23.5%。
原文摘要 · Abstract (English)
The proliferation of IoT devices has significantly increased network vulnerabilities, creating an urgent need for effective Intrusion Detection Systems (IDS). Machine Learning-based IDS (ML-IDS) offer advanced detection capabilities but rely on labeled attack data, which limits their ability to identify unknown threats. Self-Supervised Learning (SSL) presents a promising solution by using only normal data to detect patterns and anomalies. This paper introduces SAFE, a novel framework that transforms tabular network intrusion data into an image-like format, enabling Masked Autoencoders (MAEs) to learn robust representations of network behavior. The features extracted by the MAEs are then incorporated into a lightweight novelty detector, enhancing the effectiveness of anomaly detection. Experimental results demonstrate that SAFE outperforms the state-of-the-art anomaly detection method, Scale Learning-based Deep Anomaly Detection method (SLAD), by up to 26.2% and surpasses the state-of-the-art SSL-based network intrusion detection approach, Anomal-E, by up to 23.5% in F1-score.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。