Novelty Detection in Network Traffic: Using Survival Analysis for Feature Identification
Intrusion Detection Systems are an important component of many organizations' cyber defense and resiliency strategies. However, one downside of these systems is their reliance on known attack signatures for detection of malicious network events. When it comes to unknown attack types and zero-day exploits, modern Intrusion Detection Systems often fall short. In this paper, we introduce an unconventional approach to identifying network traffic features that influence novelty detection based on survival analysis techniques. Specifically, we combine several Cox proportional hazards models and implement Kaplan-Meier estimates to predict the probability that a classifier identifies novelty after the injection of an unknown network attack at any given time. The proposed model is successful at pinpointing PSH Flag Count, ACK Flag Count, URG Flag Count, and Down/Up Ratio as the main features to impact novelty detection via Random Forest, Bayesian Ridge, and Linear Support Vector Regression classifiers.
Code (0)
등록된 구현이 없습니다.
Tasks
Intrusion DetectionNovelty DetectionSurvival AnalysisSimilar Papers 제목 키워드 기반
Feature Extraction for Novelty Detection in Network Traffic
Data representation plays a critical role in the performance of novelty detection (or ``anomaly detection'') methods in machine learning. The data representation of network traffic often determines the effectiveness of t…
Anomaly DetectionBIG-bench Machine LearningMalware DetectionNovelty DetectionCND-IDS: Continual Novelty Detection for Intrusion Detection Systems
Intrusion detection systems (IDS) play a crucial role in IoT and network security by monitoring system data and alerting to suspicious activities. Machine learning (ML) has emerged as a promising solution for IDS, offeri…
Continual LearningIntrusion DetectionNovelty DetectionGeneric Multi-modal Representation Learning for Network Traffic Analysis
Network traffic analysis is fundamental for network management, troubleshooting, and security. Tasks such as traffic classification, anomaly detection, and novelty discovery are fundamental for extracting operational inf…
Anomaly DetectionFeature EngineeringRepresentation LearningTraffic ClassificationNovelty-based Generalization Evaluation for Traffic Light Detection
The advent of Convolutional Neural Networks (CNNs) has led to their application in several domains. One noteworthy application is the perception system for autonomous driving that relies on the predictions from CNNs. Pra…
Autonomous DrivingRepresentation LearningGeneralized Bayesian Ensemble Survival Tree (GBEST) model
This paper proposes a new class of predictive models for survival analysis called Generalized Bayesian Ensemble Survival Tree (GBEST). It is well known that survival analysis poses many different challenges, in particula…
modelSurvival Analysis