Network intrusion detection is a crucial line of defense for protecting network security. Despite the significant advancements made by deep learning in this field, existing methods are primarily based on closed-set classification and are ineffective in detecting unknown attacks. To address this research gap, we propose an open-set recognition-based network intrusion detection method. We first provide a network traffic classification model based on open-set recognition, OpenPN, to classify known classes of network traffic and recognize unknown network traffic. Then we introduce a novel attack detection algorithm involving expert intervention, which reduces manual costs through expert verification and utilizes a density-based k-reciprocal nearest neighbor clustering algorithm for optimization. Finally, we perform continuous learning for the classes that have been verified as novel attacks. Extensive experiments conducted on three public datasets demonstrate that the proposed method outperforms existing methods in both closed-set classification and open-set recognition. In addition, the impact of each critical parameter on the performance of the relevant algorithms is comprehensively analyzed.
GamageSSamarabanduJ. Deep learning methods in network intrusion detection: A survey and an objective comparison. J Netw Comput Appl2020; 169: 102767.
2.
Snort, an open source intrusion prevention system, 1998, https://www.snort.org/ (accessed 27 June 2023).
3.
Zeek, an open source network security monitoring tool, 1998, https://zeek.org/ (accessed 27 June 2023).
4.
Zeek, a server intrusion detection for every platform, 2006, https://www.ossec.net/ (accessed 27 June 2023).
5.
HuangXZhangY. Network intrusion detection based on an improved long-short-term memory model in combination with multiple spatiotemporal structures. Wirel Commun Mob Comput2021; 2021: 6623554.
6.
KhanRUZhangXAlazabM. An improved convolutional neural network model for intrusion detection in networks, 2019.
7.
RiyazBSannasiG. A deep learning approach for effective intrusion detection in wireless networks using CNN. Soft Comput2020; 24: 17265–17278.
8.
YinCZhuYFeiJ. A deep learning approach for intrusion detection using recurrent neural networks. IEEE Access2017; 5: 21954–21961.
ZhangYChenXJinL. Network intrusion detection: Based on deep hierarchical network and original flow data. IEEE Access2019; 7: 37004–37016.
12.
WangJenq-HaurSeptianTri Wanda. Combining oversampling with recurrent neural networks for intrusion detection. In: Jensen CS, Lam E-P, Yang D-N et al. (eds), International Conference on Database Systems for Advanced Applications, 2021, pp.305–320. Cham: Springer.
13.
LiuXLiTZhangR. A GAN and feature selection-based oversampling technique for intrusion detection. Sec Commun Netw2021; 2021: 9947059.
14.
XuCShenJDuX. A method of few-shot network intrusion detection based on meta-learning framework. IEEE Trans Inf Forens Sec2020; 15: 3540–3552.
15.
LiuAWangYLiT. SFE-GACN: A novel unknown attack detection under insufficient data via intra categories generation in embedding space. Comput Sec2021; 105: 102262.
16.
WangCWangBSunY. Intrusion detection for industrial control systems based on open set artificial neural network. Sec Commun Netw2021; 2021: 4027900.
17.
ZhangZZhangYGuoD. A scalable network intrusion detection system towards detecting, discovering, and learning unknown attacks. Int J Mach Learn Cybernet2021; 12: 1649–1665.
18.
FernándezAGarciaSHerreraF, et al.SMOTE for learning from imbalanced data: progress and challenges, marking the 15-year anniversary. J Artif Intell Res2018; 61: 863–905.
YangHMZhangXYYinF. Convolutional prototype network for open set recognition. IEEE Trans Pattern Anal Mach Intell2020; 44: 2358–2370.
21.
SnellJSwerskyKZemelR. Prototypical networks for few-shot learning. In: 31st Conference on neural information processing system, Long Beach, CA, USA, 2017.
22.
SohnK. Improved deep metric learning with multi-class n-pair loss objective. In: Advances in neural information processing systems, Barcelona, Spain, 2016.
23.
ChaiCCaoLLiG. Human-in-the-loop outlier detection. In: Proceedings of the 2020 ACM SIGMOD international conference on management of data, OR, Portland, USA, June 14–19, 2020, pp.19–33.
24.
XuDTianY. A comprehensive survey of clustering algorithms. Ann Data Sci2015; 2: 165–193.
25.
EsterMKriegelHPSanderJ. A density-based algorithm for discovering clusters in large spatial databases with noise. In: Proceedings of the second international conference on knowledge discovery and data mining, 1996, pp.226–231.
26.
AnkerstMBreunigMMKriegelHP. Optics: Ordering points to identify the clustering structure. SIGMOD Rec1999; 28: 49–60.
27.
QinDGammeterSBossardL. Hello neighbor: Accurate object retrieval with k-reciprocal nearest neighbors. In: CVPR, Colorado Springs, CO, USA, June 21–25, 2011, pp.777–784, IEEE.
28.
ZhongZZhengLCaoD, et al.Re-ranking person re-identification with k-reciprocal encoding. In: CVPR, June 21–25, 2017 IEEE.
29.
HamidYSugumaranM. A t-SNE based non linear dimension reduction for network intrusion detection. Int J Inf Technol2020; 12: 125–134.
30.
Van der MaatenLHintonG. Visualizing data using t-SNE. Journal of machine learning research2008; 9: 2579–2605.
31.
GengCHuangSjChenS. Recent advances in open set recognition: A survey. IEEE Trans Pattern Anal Mach Intell2020; 43: 3614–3631.
32.
ShuLXuHLiuB. DOC: Deep open classification of text documents. In: Proceedings of the 2017 conference on empirical methods in natural language processing, Copenhagen, Denmark, 2017, pp.2911–2916: Association for Computational Linguistics.
33.
MillerDSünderhaufNMilfordM. Class anchor clustering: A loss for distance-based open set recognition. In: 2021 IEEE Winter conference on applications of computer vision, Virtual, January 5–9, 2021, pp.3570–3578: IEEE.
34.
AsmithaPRupaCNikithaS, et al.Improved multiview biometric object detection for anti spoofing frauds. Multimed Tools Appl2024; 83: 1–17.
35.
PatroPKumarKKumarGS, et al.Intelligent data classification using optimized fuzzy neural network and improved cuckoo search optimization. Iranian J Fuzzy Syst2023; 20: 155–169.
36.
RaoRSKalabarigeLRAlankarB, et al.Multimodal imputation-based stacked ensemble for prediction and classification of air quality index in indian cities. Comput Elect Eng2024; 114: 109098.
37.
GuJZhuHHanZ, et al.Gsedroid: GNN-based android malware detection framework using lightweight semantic embedding. Comput Sec2024; 140: 103807.
38.
LingXWuLDengW, et al.Malgraph: Hierarchical graph neural networks for robust windows malware detection. In: INFOCOM, London, United Kingdom, May 02-05. , 2022. IEEE.
39.
ZhangLLiuPChoiYH, et al.Semantics-preserving reinforcement learning attack against graph neural networks for malware detection. IEEE Trans Dependable Secure Comput2023; 20: 1390–1402.
40.
Zongyuan GeSDGarnaviR. Generative openmax for multi-class open set classification. In: Proceedings of the British machine vision conference, London, Sep 04, 2017. BMVA.
