网络流量中的新颖性检测：基于生存分析的特征识别
Novelty Detection in Network Traffic: Using Survival Analysis for Feature Identification
摘要：
入侵检测系统是许多组织网络防御和弹性策略的重要组成部分。然而，这些系统的一个缺点是它们依赖于已知的攻击签名来检测恶意网络事件。当涉及到未知的攻击类型和零日漏洞利用时，现代入侵检测系统往往不足。在本文中，我们介绍了一种非常规的方法来识别网络流量的特点，影响新奇的检测生存分析技术的基础上。具体来说，我们结合了几个Cox比例风险模型，并实施Kaplan-Meier估计来预测分类器在任何给定时间注入未知网络攻击后识别新颖性的概率。所提出的模型是成功的，在精确定位PSH标志计数，ACK标志计数，URG标志计数，和下/上比率作为主要特征，通过随机森林，贝叶斯岭，和线性支持向量回归分类器影响新奇检测。
英文摘要：
Intrusion Detection Systems are an important component of many organizations' cyber defense and resiliency strategies. However, one downside of these systems is their reliance on known attack signatures for detection of malicious network events. When it comes to unknown attack types and zero-day exploits, modern Intrusion Detection Systems often fall short. In this paper, we introduce an unconventional approach to identifying network traffic features that influence novelty detection based on survival analysis techniques. Specifically, we combine several Cox proportional hazards models and implement Kaplan-Meier estimates to predict the probability that a classifier identifies novelty after the injection of an unknown network attack at any given time. The proposed model is successful at pinpointing PSH Flag Count, ACK Flag Count, URG Flag Count, and Down/Up Ratio as the main features to impact novelty detection via Random Forest, Bayesian Ridge, and Linear Support Vector Regression classifiers.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
