NetSentry：一种检测早期大规模网络攻击的深度学习方法
NetSentry: A Deep Learning Approach to Detecting Incipient Large-scale Network Attacks
摘要：
机器学习（ML）技术越来越多地被用于应对不断发展的高知名度网络攻击，包括DDoS、僵尸网络和勒索软件，因为它们具有提取隐藏在数据流中的复杂模式的独特能力。然而，这些方法通常使用在相同环境中收集的数据进行验证，并且当部署在不同的网络拓扑和/或应用于以前看不见的流量时，它们的性能会降低。这表明，恶意/良性行为在很大程度上是肤浅的学习和ML的网络入侵检测系统（NIDS）需要重新审视，在实践中是有效的。在本文中，我们深入研究了大规模网络攻击的机制，以期了解如何以原则性的方式将ML用于网络入侵检测（NID）。我们发现，虽然网络攻击在有效载荷，向量和目标方面差异很大，但它们的早期阶段对成功的攻击结果至关重要，具有许多相似之处，并表现出重要的时间相关性。因此，我们将NID视为一项对时间敏感的任务，并提出了NetSentry，这可能是第一个基于双向非对称LSTM（Bi-ALSTM）的NIDS，这是一种原始的序列神经模型集成，可以在网络威胁传播之前检测它们。我们使用两个实际数据集对NetSentry进行交叉评估，其中一个数据集进行训练，另一个数据集进行测试，并证明F1得分比最先进的数据集提高了33%以上，并且检测攻击（如XSS和Web暴力）的比率高达3倍。此外，我们还提出了一种新的数据增强技术，可以增强各种监督深度学习算法的泛化能力，使F1平均得分提高35%以上。
英文摘要：
Machine Learning (ML) techniques are increasingly adopted to tackle ever-evolving high-profile network attacks, including DDoS, botnet, and ransomware, due to their unique ability to extract complex patterns hidden in data streams. These approaches are however routinely validated with data collected in the same environment, and their performance degrades when deployed in different network topologies and/or applied on previously unseen traffic, as we uncover. This suggests malicious/benign behaviors are largely learned superficially and ML-based Network Intrusion Detection System (NIDS) need revisiting, to be effective in practice. In this paper we dive into the mechanics of large-scale network attacks, with a view to understanding how to use ML for Network Intrusion Detection (NID) in a principled way. We reveal that, although cyberattacks vary significantly in terms of payloads, vectors and targets, their early stages, which are critical to successful attack outcomes, share many similarities and exhibit important temporal correlations. Therefore, we treat NID as a time-sensitive task and propose NetSentry, perhaps the first of its kind NIDS that builds on Bidirectional Asymmetric LSTM (Bi-ALSTM), an original ensemble of sequential neural models, to detect network threats before they spread. We cross-evaluate NetSentry using two practical datasets, training on one and testing on the other, and demonstrate F1 score gains above 33% over the state-of-the-art, as well as up to 3 times higher rates of detecting attacks such as XSS and web bruteforce. Further, we put forward a novel data augmentation technique that boosts the generalization abilities of a broad range of supervised deep learning algorithms, leading to average F1 score gains above 35%.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
