Attribute Learning for Network Intrusion Detection

TL;DR

This paper introduces a novel attribute learning algorithm using decision trees for Zero-Shot Learning to improve network intrusion detection, especially for unseen attack classes, and proposes an evaluation setup for this approach.

Contribution

It presents a new decision tree-based attribute learning method for Zero-Shot Learning in network intrusion detection, addressing the challenge of detecting unseen attack types.

Findings

Decision tree rules improve attribute value distribution.

Proposed setup enables evaluation of ZSL in NID.

Enhanced detection of unseen attack classes.

Abstract

Network intrusion detection is one of the most visible uses for Big Data analytics. One of the main problems in this application is the constant rise of new attacks. This scenario, characterized by the fact that not enough labeled examples are available for the new classes of attacks is hardly addressed by traditional machine learning approaches. New findings on the capabilities of Zero-Shot learning (ZSL) approach makes it an interesting solution for this problem because it has the ability to classify instances of unseen classes. ZSL has inherently two stages: the attribute learning and the inference stage. In this paper we propose a new algorithm for the attribute learning stage of ZSL. The idea is to learn new values for the attributes based on decision trees (DT). Our results show that based on the rules extracted from the DT a better distribution for the attribute values can be found. We also propose an experimental setup for the evaluation of ZSL on network intrusion detection (NID).