3D-IDS: Doubly Disentangled Dynamic Intrusion Detection

by   Chenyang Qiu, et al.

Network-based intrusion detection system (NIDS) monitors network traffic for malicious activities, forming the frontline defense against increasing attacks over information infrastructures. Although promising, our quantitative analysis shows that existing methods perform inconsistently in declaring various unknown attacks (e.g., 9 an SVM-based method) or detecting diverse known attacks (e.g., 31 Backdoor and 93 reveals that the underlying cause is entangled distributions of flow features. This motivates us to propose 3D-IDS, a novel method that aims to tackle the above issues through two-step feature disentanglements and a dynamic graph diffusion scheme. Specifically, we first disentangle traffic features by a non-parameterized optimization based on mutual information, automatically differentiating tens and hundreds of complex features of various attacks. Such differentiated features will be fed into a memory model to generate representations, which are further disentangled to highlight the attack-specific features. Finally, we use a novel graph diffusion method that dynamically fuses the network topology for spatial-temporal aggregation in evolving data streams. By doing so, we can effectively identify various attacks in encrypted traffics, including unknown threats and known ones that are not easily detected. Experiments show the superiority of our 3D-IDS. We also demonstrate that our two-step feature disentanglements benefit the explainability of NIDS.


Host-Based Network Intrusion Detection via Feature Flattening and Two-stage Collaborative Classifier

Network Intrusion Detection Systems (NIDS) have been extensively investi...

Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis

In this paper, we propose HyperVision, a realtime unsupervised machine l...

Detecting Unknown Attacks in IoT Environments: An Open Set Classifier for Enhanced Network Intrusion Detection

The widespread integration of Internet of Things (IoT) devices across al...

Prepare for Trouble and Make it Double. Supervised and Unsupervised Stacking for AnomalyBased Intrusion Detection

In the last decades, researchers, practitioners and companies struggled ...

STC-IDS: Spatial-Temporal Correlation Feature Analyzing based Intrusion Detection System for Intelligent Connected Vehicles

Intrusion detection is an important defensive measure for the security o...

Deep Neural Networks based Meta-Learning for Network Intrusion Detection

Designing an intrusion detection system is difficult as network traffic ...

Novelty Detection in Network Traffic: Using Survival Analysis for Feature Identification

Intrusion Detection Systems are an important component of many organizat...

Please sign up or login with your details

Forgot password? Click here to reset