End-to-End Network Intrusion Detection Based on Contrastive Learning.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Traditional network intrusion detection systems (NIDS) often rely on manual feature engineering, which is becoming less effective with complex network traffic and evolving attack methods.
• The distinction between normal and malicious network behavior is blurring, challenging existing detection mechanisms.
• Current NIDS methods struggle with the detection of novel and unknown cyber threats.

Purpose of the Study:

• To propose a novel end-to-end intrusion detection framework utilizing contrastive learning.
• To develop a deep learning model capable of automatically extracting spatiotemporal features from raw network traffic.
• To enhance the capability of NIDS to detect unknown network attacks.

Main Methods:

• A hierarchical Convolutional Neural Network (CNN) and Gated Recurrent Unit (GRU) model was designed for automated spatiotemporal feature extraction.
• Contrastive learning was integrated to improve the separation between benign and malicious network traffic representations.
• The proposed framework was evaluated on the CIC-IDS2017 and CSE-CIC-IDS2018 datasets.

Main Results:

• The proposed method achieved state-of-the-art performance with 99.9% detection accuracy for known attacks.
• For unknown attacks, the framework demonstrated a weighted recall rate of 95%.
• Contrastive learning significantly enhanced the distinction between normal and malicious traffic in the learned representation space.

Conclusions:

• The end-to-end intrusion detection framework based on contrastive learning offers superior performance compared to traditional methods, especially for unknown threats.
• The CNN-GRU model effectively extracts relevant features directly from raw network traffic, reducing reliance on manual feature engineering.
• This approach represents a significant advancement in developing robust and adaptive network intrusion detection systems.