تقرير
3D-IDS: Doubly Disentangled Dynamic Intrusion Detection
| العنوان: | 3D-IDS: Doubly Disentangled Dynamic Intrusion Detection |
|---|---|
| المؤلفون: | Qiu, Chenyang, Geng, Yingsheng, Lu, Junrui, Chen, Kaida, Zhu, Shitong, Su, Ya, Nan, Guoshun, Zhang, Can, Fu, Junsong, Cui, Qimei, Tao, Xiaofeng |
| سنة النشر: | 2023 |
| المجموعة: | Computer Science |
| مصطلحات موضوعية: | Computer Science - Cryptography and Security, Computer Science - Artificial Intelligence, Computer Science - Machine Learning, Computer Science - Social and Information Networks |
| الوصف: | Network-based intrusion detection system (NIDS) monitors network traffic for malicious activities, forming the frontline defense against increasing attacks over information infrastructures. Although promising, our quantitative analysis shows that existing methods perform inconsistently in declaring various unknown attacks (e.g., 9% and 35% F1 respectively for two distinct unknown threats for an SVM-based method) or detecting diverse known attacks (e.g., 31% F1 for the Backdoor and 93% F1 for DDoS by a GCN-based state-of-the-art method), and reveals that the underlying cause is entangled distributions of flow features. This motivates us to propose 3D-IDS, a novel method that aims to tackle the above issues through two-step feature disentanglements and a dynamic graph diffusion scheme. Specifically, we first disentangle traffic features by a non-parameterized optimization based on mutual information, automatically differentiating tens and hundreds of complex features of various attacks. Such differentiated features will be fed into a memory model to generate representations, which are further disentangled to highlight the attack-specific features. Finally, we use a novel graph diffusion method that dynamically fuses the network topology for spatial-temporal aggregation in evolving data streams. By doing so, we can effectively identify various attacks in encrypted traffics, including unknown threats and known ones that are not easily detected. Experiments show the superiority of our 3D-IDS. We also demonstrate that our two-step feature disentanglements benefit the explainability of NIDS. Comment: Accepted and appeared in the proceedings of the KDD 2023 Research Track |
| نوع الوثيقة: | Working Paper |
| DOI: | 10.1145/3580305.3599238 |
| URL الوصول: | http://arxiv.org/abs/2307.11079 |
| رقم الأكسشن: | edsarx.2307.11079 |
| قاعدة البيانات: | arXiv |
| DOI: | 10.1145/3580305.3599238 |
|---|