对比五种非对比自监督方法在入侵检测中的表现
An Investigation into the Performance of Non-Contrastive Self-Supervised Learning Methods for Network Intrusion Detection
- 采用三种编码器+六种增强策略组合实验
- 在UNSW-NB15和5G-NIDD上达最优F1-score
- 适合想探索无监督入侵检测的研究者
网络入侵检测长期依赖有监督学习，但难以发现未知攻击。受计算机视觉中自监督学习成功的启发，本文系统评估了五种非对比自监督学习方法在入侵检测中的表现。实验在两个数据集UNSW-NB15和5G-NIDD上进行，共90组实验，结合三种编码器架构与六种数据增强策略。针对每个模型，报告了在平均精确率、召回率、F1分数和AUCROC上表现最佳的编码器与增强组合。结果表明，非对比方法在攻击检测任务中具备竞争力，优于两个无监督基线模型（DeepSVDD与Autoencoder）。代码已开源。
原文摘要 · Abstract (English)
Network intrusion detection, a well-explored cybersecurity field, has predominantly relied on supervised learning algorithms in the past two decades. However, their limitations in detecting only known anomalies prompt the exploration of alternative approaches. Motivated by the success of self-supervised learning in computer vision, there is a rising interest in adapting this paradigm for network intrusion detection. While prior research mainly delved into contrastive self-supervised methods, the efficacy of non-contrastive methods, in conjunction with encoder architectures serving as the representation learning backbone and augmentation strategies that determine what is learned, remains unclear for effective attack detection. This paper compares the performance of five non-contrastive self-supervised learning methods using three encoder architectures and six augmentation strategies. Ninety experiments are systematically conducted on two network intrusion detection datasets, UNSW-NB15 and 5G-NIDD. For each self-supervised model, the combination of encoder architecture and augmentation method yielding the highest average precision, recall, F1-score, and AUCROC is reported. Furthermore, by comparing the best-performing models to two unsupervised baselines, DeepSVDD, and an Autoencoder, we showcase the competitiveness of the non-contrastive methods for attack detection. Code at: https://github.com/renje4z335jh4/non_contrastive_SSL_NIDS
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。