Utilising Deep Learning Techniques for Effective Zero-Day Attack Detection

Abstract

Machine Learning (ML) and Deep Learning (DL) have been used for building Intrusion Detection Systems (IDS). The increase in both the number and sheer variety of new cyber-attacks poses a tremendous challenge for IDS solutions that rely on a database of historical attack signatures. Therefore, the industrial pull for robust IDSs that are capable of flagging zero-day attacks is growing. Current outlier-based zero-day detection research suffers from high false-negative rates, thus limiting their practical use and performance. This paper proposes an autoencoder implementation for detecting zero-day attacks. The aim is to build an IDS model with high recall while keeping the miss rate (false-negatives) to an acceptable minimum. Two well-known IDS datasets are used for evaluation-CICIDS2017 and NSL-KDD. In order to demonstrate the efficacy of our model, we compare its results against a One-Class Support Vector Machine (SVM). The manuscript highlights the performance of a One-Class SVM when zero-day attacks are distinctive from normal behaviour. The proposed model benefits greatly from autoencoders encoding-decoding capabilities. The results show that autoencoders are well-suited at detecting complex zero-day attacks. The results demonstrate a zero-day detection accuracy of [89-99%] for the NSL-KDD dataset and [75-98%] for the CICIDS2017 dataset. Finally, the paper outlines the observed trade-off between recall and fallout.

arXiv comment18 pages, 4 figures

References in corpus (10)

• N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoders
• Deep Learning for Encrypted Traffic Classification: An Overview
• Deep Reinforcement Learning for Cyber Security
• Grid Search, Random Search, Genetic Algorithm: A Big Comparison for NAS
• A Taxonomy of Network Threats and the Effect of Current Datasets on Intrusion Detection Systems
• Shallow and Deep Networks Intrusion Detection System: A Taxonomy and Survey
• Evaluation of Machine Learning Classifiers for Zero-Day Intrusion Detection -- An Analysis on CIC-AWS-2018 dataset
• AutoIDS: Auto-encoder Based Method for Intrusion Detection System
• A framework for mitigating zero-day attacks in IoT
• The Performance of Machine and Deep Learning Classifiers in Detecting Zero-Day Vulnerabilities

Cited by in corpus (4)

• From Zero-Shot Machine Learning to Zero-Day Attack Detection
• Intrusion Detection in Internet of Things using Convolutional Neural Networks
• Utilising Flow Aggregation to Classify Benign Imitating Attacks
• Few-Shot Network Intrusion Detection Using Online Triplet Mining