面向零日网络入侵检测的一种新型对比损失
A Novel Contrastive Loss for Zero-Day Network Intrusion Detection
AI总结：
本文提出一种新型对比损失函数，用于提升零日网络入侵检测的性能，通过学习良性流量和已知恶意样本的分布，有效提高对未知攻击类别的识别能力。
摘要：
机器学习在网络入侵检测中已取得最先进的成果；然而，当面对新攻击类别——零日攻击时，其性能会显著下降。简而言之，经典基于机器学习的方法擅长识别其已训练过的攻击类别，但对未包含在训练数据中的类别则表现不佳。一种解决此问题的方法是利用异常检测器，其仅训练于良性数据，旨在泛化到所有攻击类别——包括已知和零日攻击。然而，这种方法以牺牲极高的误报率为代价。本文提出了一种新型对比损失函数，能够在保持其他基于对比学习方法的优势（对不平衡数据的鲁棒性）的同时，也能泛化到零日攻击。与异常检测器不同，该模型利用良性流量和已知恶意样本学习良性流量的分布，即其他已知的攻击类别（不包括零日类别），从而实现了显著的性能提升。所提出的方法在Lycos2017数据集上进行了实验验证，其在已知和零日攻击检测上的AUROC改进分别为0.000065和0.060883。最后，该方法被扩展到开放集识别，实现了OpenAUC的0.170883的改进。
英文摘要：
Machine learning has achieved state-of-the-art results in network intrusion detection; however, its performance significantly degrades when confronted by a new attack class -- a zero-day attack. In simple terms, classical machine learning-based approaches are adept at identifying attack classes on which they have been previously trained, but struggle with those not included in their training data. One approach to addressing this shortcoming is to utilise anomaly detectors which train exclusively on benign data with the goal of generalising to all attack classes -- both known and zero-day. However, this comes at the expense of a prohibitively high false positive rate. This work proposes a novel contrastive loss function which is able to maintain the advantages of other contrastive learning-based approaches (robustness to imbalanced data) but can also generalise to zero-day attacks. Unlike anomaly detectors, this model learns the distributions of benign traffic using both benign and known malign samples, i.e. other well-known attack classes (not including the zero-day class), and consequently, achieves significant performance improvements. The proposed approach is experimentally verified on the Lycos2017 dataset where it achieves an AUROC improvement of .000065 and .060883 over previous models in known and zero-day attack detection, respectively. Finally, the proposed method is extended to open-set recognition achieving OpenAUC improvements of .170883 over existing approaches.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
