发现入侵检测数据中的正常流量其实包含多个子类别，可提升分类效果
What Does Normal Even Mean? Evaluating Benign Traffic in Intrusion Detection Datasets
- 用无监督聚类分析正常流量结构
- 发现正常流量存在多个有意义的子类
- 适合做异常检测与数据清洗的研究者参考
监督学习依赖标签数据实现高性能，但前提是标签需反映数据内在结构差异。当前网络入侵检测数据集（如NSL-KDD、UNSW-NB15、CIC-IDS 2017）通常仅设一个大类正常流量，涵盖所有非攻击行为。我们回顾了多篇相关论文和指南，发现多数研究直接采用原始标签训练模型。本文评估了上述三个数据集中正常流量的结构，探究其内部是否存在有意义的子类别，以期通过常见机器学习方法提升多分类性能。通过对比多种无监督聚类技术（如HDBSCAN、Mean Shift），我们展示了不同算法对正常流量空间的差异化划分能力。
原文摘要 · Abstract (English)
Supervised machine learning techniques rely on labeled data to achieve high task performance, but this requires the labels to capture some meaningful differences in the underlying data structure. For training network intrusion detection algorithms, most datasets contain a series of attack classes and a single large benign class which captures all non-attack network traffic. A review of intrusion detection papers and guides that explicitly state their data preprocessing steps identified that the majority took the labeled categories of the dataset at face value when training their algorithms. The present paper evaluates the structure of benign traffic in several common intrusion detection datasets (NSL-KDD, UNSW-NB15, and CIC-IDS 2017) and determines whether there are meaningful sub-categories within this traffic which may improve overall multi-classification performance using common machine learning techniques. We present an overview of some unsupervised clustering techniques (e.g., HDBSCAN, Mean Shift Clustering) and show how they differentially cluster the benign traffic space.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。