An intrusion detection model to detect zero-day attacks in unseen data using machine learning.

Area of Science:

• Cybersecurity and Network Defense
• Machine Learning for Anomaly Detection
• Intrusion Detection Systems

Background:

• Escalating cybersecurity threats, including zero-day attacks, challenge existing detection systems.
• The rapid evolution of digital technology necessitates advanced methods for identifying novel cyber threats.
• Current intrusion detection systems often struggle with the sophisticated nature of zero-day exploits.

Purpose of the Study:

• To develop and evaluate an enhanced intrusion detection system for zero-day attacks.
• To investigate the efficacy of autoencoders for anomaly detection in cybersecurity contexts.
• To improve the performance of traditional machine learning models by integrating anomaly detection capabilities.

Main Methods:

• Utilized the CIC-MalMem-2022 dataset for training and testing intrusion detection models.
• Employed autoencoders for anomaly detection to identify deviations from normal network behavior.
• Integrated a trained autoencoder with XGBoost and Random Forest algorithms, creating XGBoost-AE and Random Forest-AE models.

Main Results:

• The Random Forest-AE model achieved 100% accuracy, precision, recall, F1 score, and MCC on the training data.
• The proposed Random Forest-AE model significantly outperformed previously published methods.
• On unseen data, Random Forest-AE maintained exceptional performance with 99.9892% accuracy and near-perfect precision, recall, and F1 scores.

Conclusions:

• Integrating anomaly detection with traditional models substantially enhances intrusion detection performance.
• The Random Forest-AE model demonstrates high effectiveness and robustness in detecting zero-day cyber threats.
• The proposed approach offers a promising solution for real-time cybersecurity threat identification, even with novel attacks.