新框架持续识别网络攻击，无需标注即可发现未知威胁。
CND-IDS: Continual Novelty Detection for Intrusion Detection Systems
- 用动态特征提取+主成分分析重建异常检测
- 在真实数据集上提升6.1倍精准率，迁移性能强于顶尖无监督方法
- 适合应对不断变化的网络攻击，尤其零日攻击场景
入侵检测系统（IDS）在物联网与网络安全中至关重要，通过监控系统数据并预警可疑行为。机器学习（ML）为IDS提供了高精度解决方案，但现有方法常忽视两个关键问题：持续变化的数据流和攻击标签缺失。网络流量及攻击类型不断演进，导致部署的机器学习模型性能下降；而现实中难以对零日攻击等新型威胁进行标注，因此亟需不依赖标签的方案。为此，本文提出CND-IDS——一种持续新颖性检测的入侵检测框架，包含（i）可不断更新系统数据特征表示的学习型特征提取器，以及（ii）基于主成分分析（PCA）重构误差的新攻击识别机制。在真实入侵数据集上的实验表明，该框架在F-score上最高提升6.1倍，前向迁移能力较当前最优无监督持续学习算法提升6.5倍。代码将在论文接收后公开。
原文摘要 · Abstract (English)
Intrusion detection systems (IDS) play a crucial role in IoT and network security by monitoring system data and alerting to suspicious activities. Machine learning (ML) has emerged as a promising solution for IDS, offering highly accurate intrusion detection. However, ML-IDS solutions often overlook two critical aspects needed to build reliable systems: continually changing data streams and a lack of attack labels. Streaming network traffic and associated cyber attacks are continually changing, which can degrade the performance of deployed ML models. Labeling attack data, such as zero-day attacks, in real-world intrusion scenarios may not be feasible, making the use of ML solutions that do not rely on attack labels necessary. To address both these challenges, we propose CND-IDS, a continual novelty detection IDS framework which consists of (i) a learning-based feature extractor that continuously updates new feature representations of the system data, and (ii) a novelty detector that identifies new cyber attacks by leveraging principal component analysis (PCA) reconstruction. Our results on realistic intrusion datasets show that CND-IDS achieves up to 6.1x F-score improvement, and up to 6.5x improved forward transfer over the SOTA unsupervised continual learning algorithm. Our code will be released upon acceptance.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。