Prepare for Trouble and Make it Double. Supervised and Unsupervised Stacking for AnomalyBased Intrusion Detection
Tommaso Zoppi, Andrea Ceccarelli

TL;DR
This paper introduces a meta-learning stacking approach combining supervised and unsupervised machine learning to improve network intrusion detection, especially for zero-day attacks, and demonstrates its superior performance over existing methods.
Contribution
The paper proposes a novel two-layer stacking method that integrates supervised and unsupervised learners for enhanced intrusion detection, addressing zero-day attack detection.
Findings
Reduces misclassification rates across 7 datasets
Outperforms existing methods in 6 out of 7 datasets
More effective in detecting zero-day attacks
Abstract
In the last decades, researchers, practitioners and companies struggled in devising mechanisms to detect malicious activities originating security threats. Amongst the many solutions, network intrusion detection emerged as one of the most popular to analyze network traffic and detect ongoing intrusions based on rules or by means of Machine Learners (MLs), which process such traffic and learn a model to suspect intrusions. Supervised MLs are very effective in detecting known threats, but struggle in identifying zero-day attacks (unknown during learning phase), which instead can be detected through unsupervised MLs. Unfortunately, there are no definitive answers on the combined use of both approaches for network intrusion detection. In this paper we first expand the problem of zero-day attacks and motivate the need to combine supervised and unsupervised algorithms. We propose the adoption…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
