网络入侵检测中的分布偏移检测与适应
Shift Detection and Adaptation for Network Intrusion Detection
AI总结：
本文提出NetSight框架，通过在线持续检测和适应分布偏移，提升网络入侵检测的鲁棒性，实验表明其在F1-score上优于依赖人工标注的现有方法。
摘要：
分布偏移，即数据统计特性随时间变化，对深度学习异常检测系统构成重大挑战。现有异常检测系统难以适应这些偏移。监督学习系统需昂贵的人工标注，而无监督学习系统依赖干净数据进行偏移适应，但干净数据难以获取。本文引入NetSight框架，通过新颖的伪标注技术消除人工干预，并利用知识蒸馏策略防止灾难性遗忘。在三个长期网络数据集上评估，NetSight在F1-score上优于依赖人工标注的现有方法，最高提升达11.72%，证明其在动态网络中的鲁棒性和有效性。
英文摘要：
Distribution shift, a change in the statistical properties of data over time, poses a critical challenge for deep learning anomaly detection systems. Existing anomaly detection systems often struggle to adapt to these shifts. Specifically, systems based on supervised learning require costly manual labeling, while those based on unsupervised learning rely on clean data, which is difficult to obtain, for shift adaptation. Both of these requirements are challenging to meet in practice. In this paper, we introduce NetSight, a framework for supervised anomaly detection in network data that continually detects and adapts to distribution shifts in an online manner. NetSight eliminates manual intervention through a novel pseudo-labeling technique and uses a knowledge distillation-based adaptation strategy to prevent catastrophic forgetting. Evaluated on three long-term network datasets, NetSight demonstrates superior adaptation performance compared to state-of-the-art methods that rely on manual labeling, achieving F1-score improvements of up to 11.72%. This proves its robustness and effectiveness in dynamic networks that experience distribution shifts over time.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
