对比五种监督学习模型，找出高效检测未知攻击的最优方案。
A Comprehensive Study of Supervised Machine Learning Models for Zero-Day Attack Detection: Analyzing Performance on Imbalanced Data
- 用网格搜索、降维和过采样处理数据不平衡问题。
- 随机森林表现最好，但梯度提升更快且准确率高。
- 适合网络安全研究者与攻防系统开发者参考。
零日攻击因缺乏已知特征而难以被现有安全系统识别。本研究评估了五种监督学习模型在零日攻击检测中的性能与运行时间，针对高度不平衡的数据集，提出结合网格搜索、降维和过采样方法的框架以缓解类别不平衡问题。实验中仅在测试阶段引入零日攻击，确保模型未被训练识别此类攻击。结果表明，随机森林（RF）在有无过采样条件下均表现最佳，但耗时较长；相比之下，XGBoost（XGB）在保持高准确率的同时实现更快的检测速度，因此被选为最优模型。
原文摘要 · Abstract (English)
Among the various types of cyberattacks, identifying zero-day attacks is problematic because they are unknown to security systems as their pattern and characteristics do not match known blacklisted attacks. There are many Machine Learning (ML) models designed to analyze and detect network attacks, especially using supervised models. However, these models are designed to classify samples (normal and attacks) based on the patterns they learn during the training phase, so they perform inefficiently on unseen attacks. This research addresses this issue by evaluating five different supervised models to assess their performance and execution time in predicting zero-day attacks and find out which model performs accurately and quickly. The goal is to improve the performance of these supervised models by not only proposing a framework that applies grid search, dimensionality reduction and oversampling methods to overcome the imbalance problem, but also comparing the effectiveness of oversampling on ml model metrics, in particular the accuracy. To emulate attack detection in real life, this research applies a highly imbalanced data set and only exposes the classifiers to zero-day attacks during the testing phase, so the models are not trained to flag the zero-day attacks. Our results show that Random Forest (RF) performs best under both oversampling and non-oversampling conditions, this increased effectiveness comes at the cost of longer processing times. Therefore, we selected XG Boost (XGB) as the top model due to its fast and highly accurate performance in detecting zero-day attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。