Transfer learning for detecting unknown network attacks
Abstract Network attacks are serious concerns in today’s increasingly interconnected society. Recent studies have applied conventional machine learning to network attack detection by learning the patterns of the network behaviors and training a classification model. These models usually require larg...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
SpringerOpen
2019-02-01
|
| Series: | EURASIP Journal on Information Security |
| Subjects: | |
| Online Access: | http://link.springer.com/article/10.1186/s13635-019-0084-4 |
| _version_ | 1811327981690290176 |
|---|---|
| author | Juan Zhao Sachin Shetty Jan Wei Pan Charles Kamhoua Kevin Kwiat |
| author_facet | Juan Zhao Sachin Shetty Jan Wei Pan Charles Kamhoua Kevin Kwiat |
| author_sort | Juan Zhao |
| collection | DOAJ |
| description | Abstract Network attacks are serious concerns in today’s increasingly interconnected society. Recent studies have applied conventional machine learning to network attack detection by learning the patterns of the network behaviors and training a classification model. These models usually require large labeled datasets; however, the rapid pace and unpredictability of cyber attacks make this labeling impossible in real time. To address these problems, we proposed utilizing transfer learning for detecting new and unseen attacks by transferring the knowledge of the known attacks. In our previous work, we have proposed a transfer learning-enabled framework and approach, called HeTL, which can find the common latent subspace of two different attacks and learn an optimized representation, which was invariant to attack behaviors’ changes. However, HeTL relied on manual pre-settings of hyper-parameters such as relativeness between the source and target attacks. In this paper, we extended this study by proposing a clustering-enhanced transfer learning approach, called CeHTL, which can automatically find the relation between the new attack and known attack. We evaluated these approaches by stimulating scenarios where the testing dataset contains different attack types or subtypes from the training set. We chose several conventional classification models such as decision trees, random forests, KNN, and other novel transfer learning approaches as strong baselines. Results showed that proposed HeTL and CeHTL improved the performance remarkably. CeHTL performed best, demonstrating the effectiveness of transfer learning in detecting new network attacks. |
| first_indexed | 2024-04-13T15:17:34Z |
| format | Article |
| id | doaj.art-3004f631e22e4a34a191a0025fe51284 |
| institution | Directory Open Access Journal |
| issn | 2510-523X |
| language | English |
| last_indexed | 2024-04-13T15:17:34Z |
| publishDate | 2019-02-01 |
| publisher | SpringerOpen |
| record_format | Article |
| series | EURASIP Journal on Information Security |
| spelling | doaj.art-3004f631e22e4a34a191a0025fe512842022-12-22T02:41:48ZengSpringerOpenEURASIP Journal on Information Security2510-523X2019-02-012019111310.1186/s13635-019-0084-4Transfer learning for detecting unknown network attacksJuan Zhao0Sachin Shetty1Jan Wei Pan2Charles Kamhoua3Kevin Kwiat4Vanderbilt University Medical CenterVirginia Modeling Analysis and Simulation Center, Old Dominion UniversityAutoX Inc, San JoseUS Army Research Laboratory’s Network Security BranchHaloed Sun TEK, LLC, in affiliation with the CAESAR Group, SarasotaAbstract Network attacks are serious concerns in today’s increasingly interconnected society. Recent studies have applied conventional machine learning to network attack detection by learning the patterns of the network behaviors and training a classification model. These models usually require large labeled datasets; however, the rapid pace and unpredictability of cyber attacks make this labeling impossible in real time. To address these problems, we proposed utilizing transfer learning for detecting new and unseen attacks by transferring the knowledge of the known attacks. In our previous work, we have proposed a transfer learning-enabled framework and approach, called HeTL, which can find the common latent subspace of two different attacks and learn an optimized representation, which was invariant to attack behaviors’ changes. However, HeTL relied on manual pre-settings of hyper-parameters such as relativeness between the source and target attacks. In this paper, we extended this study by proposing a clustering-enhanced transfer learning approach, called CeHTL, which can automatically find the relation between the new attack and known attack. We evaluated these approaches by stimulating scenarios where the testing dataset contains different attack types or subtypes from the training set. We chose several conventional classification models such as decision trees, random forests, KNN, and other novel transfer learning approaches as strong baselines. Results showed that proposed HeTL and CeHTL improved the performance remarkably. CeHTL performed best, demonstrating the effectiveness of transfer learning in detecting new network attacks.http://link.springer.com/article/10.1186/s13635-019-0084-4Network attacks detectionMachine learningTransfer learning |
| spellingShingle | Juan Zhao Sachin Shetty Jan Wei Pan Charles Kamhoua Kevin Kwiat Transfer learning for detecting unknown network attacks EURASIP Journal on Information Security Network attacks detection Machine learning Transfer learning |
| title | Transfer learning for detecting unknown network attacks |
| title_full | Transfer learning for detecting unknown network attacks |
| title_fullStr | Transfer learning for detecting unknown network attacks |
| title_full_unstemmed | Transfer learning for detecting unknown network attacks |
| title_short | Transfer learning for detecting unknown network attacks |
| title_sort | transfer learning for detecting unknown network attacks |
| topic | Network attacks detection Machine learning Transfer learning |
| url | http://link.springer.com/article/10.1186/s13635-019-0084-4 |
| work_keys_str_mv | AT juanzhao transferlearningfordetectingunknownnetworkattacks AT sachinshetty transferlearningfordetectingunknownnetworkattacks AT janweipan transferlearningfordetectingunknownnetworkattacks AT charleskamhoua transferlearningfordetectingunknownnetworkattacks AT kevinkwiat transferlearningfordetectingunknownnetworkattacks |