A Generalized and Real-Time Network Intrusion Detection System Through Incremental Feature Encoding and Similarity...

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• Traditional Network Intrusion Detection Systems (NIDSs) often process network traffic post-completion, hindering real-time detection capabilities.
• Existing packet-based NIDSs may process packets independently, leading to reduced accuracy, while some advanced methods struggle with variable session lengths and detecting unseen threats.

Purpose of the Study:

• To develop an advanced NIDS capable of real-time intrusion detection by analyzing packet sequences within ongoing sessions.
• To create a method that efficiently handles sessions of varying lengths and accurately detects both observed and novel attack patterns.

Main Methods:

• Extracting features from consecutive packets of ongoing network sessions in an online fashion.
• Learning a compact and discriminative embedding space utilizing a novel multi-proxy similarity loss function.
• Employing a class-wise thresholding approach to address class imbalance and enhance detection accuracy for observed and novel attacks.

Main Results:

• The proposed method effectively detects attack activities by processing fewer than seven packets of an ongoing session.
• Experimental results on two large-scale datasets demonstrate superior performance compared to existing methods in detecting both known and novel attacks.
• The system successfully alleviates the imbalance issue common in NIDS datasets.

Conclusions:

• The developed online, packet-based NIDS method offers a significant advancement in real-time threat detection.
• The approach demonstrates high efficacy in identifying a wide range of cyber threats, including previously unobserved attack types.
• This method provides a more efficient and effective solution for modern network security challenges.