Intrusion Detection using Spatial-Temporal features based on Riemannian Manifold

TL;DR

This paper introduces a novel Riemannian manifold-based feature extraction method using covariance matrices to improve real-time detection of malicious network traffic by capturing spatial-temporal relationships more efficiently.

Contribution

The paper proposes a new covariance matrix-based feature extraction technique on Riemannian manifolds for network intrusion detection, reducing computational costs and manual intervention.

Findings

Outperforms existing methods on NSL-KDD dataset

Achieves higher detection accuracy on UNSW-NB15 dataset

Reduces computational complexity for real-time processing

Abstract

Network traffic data is a combination of different data bytes packets under different network protocols. These traffic packets have complex time-varying non-linear relationships. Existing state-of-the-art methods rise up to this challenge by fusing features into multiple subsets based on correlations and using hybrid classification techniques that extract spatial and temporal characteristics. This often requires high computational cost and manual support that limit them for real-time processing of network traffic. To address this, we propose a new novel feature extraction method based on covariance matrices that extract spatial-temporal characteristics of network traffic data for detecting malicious network traffic behavior. The covariance matrices in our proposed method not just naturally encode the mutual relationships between different network traffic values but also have well-defined geometry that falls in the Riemannian manifold. Riemannian manifold is embedded with distance metrics that facilitate extracting discriminative features for detecting malicious network traffic. We evaluated our model on NSL-KDD and UNSW-NB15 datasets and showed our proposed method significantly outperforms the conventional method and other existing studies on the dataset.