一个通用和实时网络入侵检测系统通过增量特征编码和相似性嵌入学习
Zahraa Kadhim Alitbi1, Seyed Amin Hosseini Seno1, Abbas Ghaemi Bafghi1
1Computer Engineering Department, Engineering Faculty, Ferdowsi University of Mashhad (FUM), Mashhad 91779-48974, Iran.
Sensors (Basel, Switzerland)
|August 28, 2025
概括
本研究引入了一种用于实时网络入侵检测系统 (NIDS) 的新方法,该方法有效地使用最小的数据包识别已知的和新的网络攻击. 系统学习一个紧的嵌入空间以有效和准确地检测威胁.
科学领域:
- 网络安全
- 网络安全
- 机器学习
背景情况:
- 传统的网络入侵检测系统 (NIDS) 通常在网络流量完成后处理,从而阻碍实时检测能力.
- 现有的基于数据包的NIDS可以独立处理数据包,导致精度降低,而一些先进的方法则难以处理可变的会话长度和检测未见的威胁.
研究的目的:
- 通过分析正在进行的会话中的数据包序列,开发能够实时检测入侵的先进NIDS.
- 创建一种有效处理不同长度的会议并准确检测观察到的和新型攻击模式的方法.
主要方法:
- 通过在线方式从连续的网络会话中提取特征.
- 学习一个紧而有区别的嵌入空间,使用一个新的多代理相似性损失函数.
- 采用分类值方法来解决分类不平衡问题,并提高观察到的新型攻击的检测准确性.
主要成果:
- 通过处理正在进行的会话中的不到七个数据包,拟议的方法可以有效地检测攻击活动.
- 两种大规模数据集的实验结果显示,在检测已知和新型攻击方面,与现有方法相比,性能优越.
- 该系统成功地缓解了NIDS数据集中常见的失衡问题.
结论:
- 在线开发的基于数据包的NIDS方法在实时威胁检测方面取得了重大进展.
- 该方法在识别广泛的网络威胁方面表现出高效,包括以前未被观察到的攻击类型.
- 这种方法为现代网络安全挑战提供了更高效和有效的解决方案.
相关概念视频
01:26Classification of Systems-I
294
Linearity is a system property characterized by a direct input-output relationship, combining homogeneity and additivity.
Homogeneity dictates that if an input x(t) is multiplied by a constant c, the output y(t) is multiplied by the same constant. Mathematically, this is expressed as:
Homogeneity dictates that if an input x(t) is multiplied by a constant c, the output y(t) is multiplied by the same constant. Mathematically, this is expressed as:
294
01:31Classification of Systems-II
240
Continuous-time systems have continuous input and output signals, with time measured continuously. These systems are generally defined by differential or algebraic equations. For instance, in an RC circuit, the relationship between input and output voltage is expressed through a differential equation derived from Ohm's law and the capacitor relation,
240
01:18Introduction to Learning
529
Learning is the process of acquiring knowledge or skills through practice or experience, leading to long-lasting behavioral changes. This acquisition occurs through interaction with the environment and requires practice or experience. For instance, mastering a skill such as surfing requires considerable practice and experience, highlighting the essential role of repeated interactions with the environment in learning.
In contrast to learned behaviors, unlearned behaviors such as crying, sexual...
In contrast to learned behaviors, unlearned behaviors such as crying, sexual...
529
01:19Encoding
244
Information enters the brain through encoding, which is the input of information into the memory system. Once sensory information is received from the environment, the brain labels or codes it. The information is then organized with similar information and connected to existing concepts. Encoding occurs through automatic processing and effortful processing.
Automatic processing involves the encoding of details like time, space, frequency, and the meaning of words, usually done without conscious...
Automatic processing involves the encoding of details like time, space, frequency, and the meaning of words, usually done without conscious...
244