对比四种模型在已知与未知攻击下的表现，找出现实场景中最可靠的检测方案。
Robust Anomaly Detection in Network Traffic: Evaluating Machine Learning Models on CICIDS2017
- 用四种模型在CICIDS2017上测试已知与未知攻击的检测能力。
- 监督模型对新攻击召回率骤降，无监督模型误报高但能发现未知威胁。
- 边界型OCSVM在准确率与召回率间平衡最佳，适合动态网络环境。
识别适用于入侵检测的机器学习范式对构建有效且可泛化的安全解决方案至关重要。本研究在两个场景下，对四种代表性模型——多层感知机（MLP）、一维卷积神经网络（1D CNN）、一类支持向量机（OCSVM）和局部离群因子（LOF）——在CICIDS2017数据集上的表现进行了受控比较：一是检测已知攻击类型，二是泛化至未见过的新威胁。结果表明，监督型MLP与CNN在已知攻击上达到接近完美的准确率，但在新攻击上召回率大幅下降；无监督型LOF虽整体准确率中等，对未知威胁召回率高，但误报率上升；而基于边界的OCSVM在两种场景下均表现出最佳的精度与召回平衡，展现出更强的鲁棒性。这些发现为动态网络环境中入侵检测系统模型的选择提供了实用指导。
原文摘要 · Abstract (English)
Identifying suitable machine learning paradigms for intrusion detection remains critical for building effective and generalizable security solutions. In this study, we present a controlled comparison of four representative models - Multi-Layer Perceptron (MLP), 1D Convolutional Neural Network (CNN), One-Class Support Vector Machine (OCSVM) and Local Outlier Factor (LOF) - on the CICIDS2017 dataset under two scenarios: detecting known attack types and generalizing to previously unseen threats. Our results show that supervised MLP and CNN achieve near-perfect accuracy on familiar attacks but suffer drastic recall drops on novel attacks. Unsupervised LOF attains moderate overall accuracy and high recall on unknown threats at the cost of elevated false alarms, while boundary-based OCSVM balances precision and recall best, demonstrating robust detection across both scenarios. These findings offer practical guidance for selecting IDS models in dynamic network environments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。