Unknown intrusion traffic detection method based on unsupervised learning and open-set recognition.

Area of Science:

• Computer Science
• Cybersecurity
• Network Security

Background:

• Intrusion detection systems (IDS) are crucial for network security and user privacy.
• Current IDS often suffer from low classification accuracy and a focus on closed-set detection, failing to identify novel threats.
• There is a need for robust methods to detect and classify unknown (open set) network traffic.

Purpose of the Study:

• To propose a novel detection and classification model for open set network traffic.
• To address the limitations of existing intrusion traffic detection algorithms, particularly their low accuracy and closed-set nature.
• To enhance the ability of intrusion detection systems to identify previously unseen malicious network activities.

Main Methods:

• Development of an open set traffic detection and classification model integrating an information maximization generative adversarial network (GM) and the OpenMax algorithm.
• Training an intrusion traffic classification model under closed-set conditions.
• Recalculating sample activation vectors using the OpenMax algorithm to estimate probabilities for unknown traffic categories.

Main Results:

• The proposed model achieved high classification accuracy on the CICIDS2017 dataset for open set traffic.
• Misuse detection accuracy exceeded 88.5%, and anomaly detection accuracy surpassed 88.2%.
• The model demonstrated effectiveness in detecting various types of unknown traffic with significant accuracy and robustness.

Conclusions:

• The developed model provides an effective solution for open set intrusion traffic detection and classification.
• The integration of GM and OpenMax enhances the identification of unknown network threats.
• The findings contribute to improving network communication security and protecting user information privacy against evolving cyber threats.