Deep Generative Learning Models for Cloud Intrusion Detection Systems

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Machine Learning

Background:

• Cloud environments face evolving cyber threats, necessitating robust intrusion detection systems (IDS).
• Existing machine learning-based IDS struggle with detecting novel attacks due to a scarcity of malicious samples and rapid attack evolution.
• Developing a cloud IDS resilient to a wide array of unknown attacks remains a significant challenge.

Purpose of the Study:

• To propose a novel solution for robust cloud intrusion detection systems (IDS) using deep neural networks.
• To develop deep generative models for synthesizing diverse malicious samples within cloud systems.
• To enhance the accuracy and robustness of machine learning algorithms in cloud-based intrusion detection.

Main Methods:

• Development of two deep generative models: conditional denoising adversarial autoencoder (CDAAE) for specific malicious sample generation and CDAAE-KNN for borderline sample generation.
• Augmentation of existing datasets by merging synthesized malicious samples with original data.
• Training and analysis of three machine learning algorithms on the augmented datasets to evaluate performance.

Main Results:

• The proposed techniques significantly improve the accuracy of cloud intrusion detection systems (IDS) compared to baseline and state-of-the-art methods.
• Experiments on four popular IDS datasets demonstrate the effectiveness of the synthesized samples in enhancing detection capabilities.
• The models show enhanced accuracy in detecting challenging distributed denial of service (DDoS) attacks, including low-rate and application layer variants.

Conclusions:

• Deep generative models offer a viable solution for overcoming the lack of malicious samples in training robust cloud IDS.
• The CDAAE and CDAAE-KNN models effectively synthesize diverse malicious samples, improving IDS accuracy and resilience.
• This approach advances the field of cloud security by enabling more effective detection of known and unknown cyber threats.