Anomaly 기반 네트워크 침입 탐지 시스템의 다중 클래스 분류를 위한 지속학습 전략 도입
Adoption of Continual Learning Strategies in Anomaly-Based Network Intrusion Detection Systems for Multi-Class Classification
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
네트워크 침입 탐지 시스템(NIDS)은 트래픽의 양적 증가와 복잡성이 높아지고있는 네트워크에서 이상 징후를 탐지하기 위해 심층신경망 모델을 적극 도입하고있는 추세이다. 그러나, 스트리밍 형태로 지속 유입되는 동적 학습 환경에서심층신경망은 치명적 망각(CF) 문제를 극복할 수 있는 지속학습(Continual Learning) 전략이 필요하다. 본 연구에서는 NIDS의 심층신경망 모델이 현실적인트래픽 유입 환경에서 이상 징후 탐지 시 위협의 구체적인 종류까지 추론할 수있는 다중 클래스 분류가 가능하도록 지속학습을 수행할 수 있는지에 대해실증했다. 실험 결과, 모델은 생성적 재생 유형의 지속학습 전략을 기반으로순차적 학습을 수행한 경우 CF 문제를 성공적으로 극복할 수 있었다. 본 연구의실험 결과를 바탕으로, 심층신경망 모델 구조를 NIDS 분야 특성에 적합하도록개선하는 것과 다양한 유형의 지속학습 전략 간 효율성과 효과성에 대한 계량적분석을 수행하는 것을 향후 연구의 발전 방향으로 설정하였다.
Abstract
Network Intrusion Detection Systems (NIDS) are actively adopting DNN models to detect anomalies in modern networks that are experiencing a quantitative increase in traffic volume with a growing complexity due to the contemporary prevalence of online services. However, in dynamic learning environments where data continuously flows in a stream fashion, such as a network traffic inspection environment, DNNs require Continual Learning (CL) strategies to overcome the Catastrophic Forgetting (CF) problem. This study empirically investigates whether the DNN models of NIDS can perform CL for multi-class classification in realistic traffic influx environments for inspection, which not only detects anomalies but also infers the specific types of threats. The experimental results indicate that the DNN model could successfully overcome the CF problem when it was sequentially trained on different datasets based on CL strategies in the generative replay category. The study has identified future research directions aimed at two goals: improving the structure of DNN models to be more suitable for the data characteristics of the NIDS domain and conducting quantitative analyses on the effectiveness and efficiency of CL strategies in various categories.
참고문헌 (24)
- Yang, Huan, "Deep-learning-based network intrusion detection for SCADA systems", 2019 IEEE Conference on Communications and Networ k Security (CNS), pp.1~7 (2019), IEEE
- Han, Dongqi, "Deepaid: Interpreting and improving deep learningbased anomaly detection in security applications", Proceedings of the 2021ACM SIGSAC Conference on Computer and Communications Security, pp.3197~3217 (2021)
- Gamage, Sunanda, "Deep learning methods in network intrusion detection : A survey and an objective comparison", Journal of Network and Computer Applications, 169, pp.102767~ (2020)
- Mirsky, Yisroel, "Kitsune: an ensemble of autoencoders for online network intrusion detection", arXiv preprint arXiv:1802.09089, ~ (2018)
- Yang, Kaichen, "Adversarial examples against the deep learning based network intrusion detection systems", MILCOM 2018-2018 ieee military communications conference (MILCOM), pp.559~564 (2018), IEEE
- Maltoni, Davide, "Continuous learning in single-incremental-task scenarios", Neural Networks, 116, pp.56~73 (2019)
- Amalapuram, Suresh Kumar, "On handling class imbalance in continual learning based network intrusion detection systems", Proceedings of the First Internationa l Conference on AI-ML Systems, pp.1~7 (2021)
- Amalapuram, Suresh Kumar, "Continual learning for anomaly based network intrusion detection", 2022 14th International Conference on COMmunication Systems & NETworkS (COMSNETS), pp.497~505 (2022), IEEE
- Kim, Hyejin, "Continual Learning with Network Intrusion Dataset", 2022 IEEE International Conference on Big Data (Big Data), pp.6702~6704 (2022), IEEE
- Sperotto, Anna, "An overview of IP flow-based intrusion detection", IEEE communications surveys & tutorials, 12(3), pp.343~356 (2010)
- Umer, Muhammad Fahad, "Flow-based intrusion detection: Techniques and challenges", Computers & Security, 70, pp.238~254 (2017)
- Ingre, Bhupendra, "Information and Communicatio n Technology for Intelligent Systems (ICTIS 2017)-Volume 22", pp.207~218 (2018), Springer International Publishing
- Ahmad, Muhammad, "Intrusion detection in internet of things using supervised machine learning based on application and transport layer features using UNSW-NB15 data-set", EURASIP Journal on Wireless Communications and Networking, 2021(1), pp.1~23 (2021)
- Jing, Dishan, "SVM based network intrusion detection for the UNSW-NB15 dataset", 2019 IEEE 13th international conference on ASIC (ASICON), pp.1~4 (2019), IEEE
- Shone, Nathan, "A deep learning approach to network intrusion detection", IEEE transactions on emerging topics in computational intelligence, 2(1), pp.41~50 (2018)
- Rusu, Andrei A, "Progressive neural networks", arXiv preprint arXiv:1606.04671, ~ (2016)
- Shin, Hanul, "Continual learning with deep generative replay", Advances in neural information processing systems, 30 (2017)
- Kirkpatrick, James, "Overcoming catastrophic forgetting in neural networks", Proceedings of the national academy of sciences, 114(13), pp.3521~3526 (2017)
- Van de Ven, Gido M., "Three scenarios for continual learning", arXiv preprint arXiv:1904.07734, ~ (2019)
- Merlin, Gabriele, "Practical recommendations for replay-based continual learning methods", International Conference on Image Analysis and Processing, pp.548~559 (2022), Springer International Publishing
- Rebuffi, Sylvestre-Alvise, "icarl: Incremental classifier and representation learning", Proceedin gs of the IEEE conference on Computer Vision and Pattern Recognition, pp.2001~2010 (2017)
- Sharafaldin, Iman, "Toward generating a new intrusion detection dataset and intrusion traffic characterization", ICISSp, 1, pp.108~116 (2018)
- Paszke, Adam, "PyTorch: An Imperative Style, High-Performance Deep Learning Library", Advances in Neural Information Processing Systems, 32 (2019)
- Ashrapov, Insaf, "GANs for Tabular Data. 2020", Github repository, ~ (2020)