NetSight在线检测并自适应网络流量分布漂移，无需人工标注。
Shift Detection and Adaptation for Network Intrusion Detection
- 用伪标签技术实现无监督在线检测分布漂移
- 知识蒸馏策略避免模型遗忘，提升长期性能
- 在3个真实数据集上比现有方法最高提升11.72%的F1分数
分布漂移，即数据统计特性随时间变化，对深度学习异常检测系统构成重大挑战。现有系统要么依赖昂贵的人工标注（监督学习），要么需要纯净数据进行漂移适应（无监督学习），两者在实际中均难实现。本文提出NetSight框架，一种面向网络数据的监督式异常检测方法，可持续在线检测并适应分布漂移。该框架通过新型伪标签技术消除人工干预，并采用基于知识蒸馏的适应策略防止灾难性遗忘。在三个长期网络数据集上的评估表明，相比依赖人工标注的最先进方法，NetSight在适应性能上表现更优，F1分数最高提升11.72%，验证了其在动态网络中的鲁棒性与有效性。
原文摘要 · Abstract (English)
Distribution shift, a change in the statistical properties of data over time, poses a critical challenge for deep learning anomaly detection systems. Existing anomaly detection systems often struggle to adapt to these shifts. Specifically, systems based on supervised learning require costly manual labeling, while those based on unsupervised learning rely on clean data, which is difficult to obtain, for shift adaptation. Both of these requirements are challenging to meet in practice. In this paper, we introduce NetSight, a framework for supervised anomaly detection in network data that continually detects and adapts to distribution shifts in an online manner. NetSight eliminates manual intervention through a novel pseudo-labeling technique and uses a knowledge distillation-based adaptation strategy to prevent catastrophic forgetting. Evaluated on three long-term network datasets, NetSight demonstrates superior adaptation performance compared to state-of-the-art methods that rely on manual labeling, achieving F1-score improvements of up to 11.72%. This proves its robustness and effectiveness in dynamic networks that experience distribution shifts over time.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。