Semi-WTC: A Practical Semi-supervised Framework for Attack Categorization through Weight-Task Consistency

TL;DR

This paper introduces Semi-WTC, a semi-supervised attack categorization framework that effectively handles data imbalance and unseen attacks, improving accuracy and reducing training time.

Contribution

It proposes a novel semi-supervised framework with Weight-Task Consistency and Active Adaption Resampling for improved attack categorization.

Findings

Achieves 3% higher classification accuracy than state-of-the-art methods.

Reduces training time by 90%.

Effectively handles data imbalance and unseen attack types.

Abstract

Supervised learning has been widely used for attack categorization, requiring high-quality data and labels. However, the data is often imbalanced and it is difficult to obtain sufficient annotations. Moreover, supervised models are subject to real-world deployment issues, such as defending against unseen artificial attacks. To tackle the challenges, we propose a semi-supervised fine-grained attack categorization framework consisting of an encoder and a two-branch structure and this framework can be generalized to different supervised models. The multilayer perceptron with residual connection is used as the encoder to extract features and reduce the complexity. The Recurrent Prototype Module (RPM) is proposed to train the encoder effectively in a semi-supervised manner. To alleviate the data imbalance problem, we introduce the Weight-Task Consistency (WTC) into the iterative process of RPM by assigning larger weights to classes with fewer samples in the loss function. In addition, to cope with new attacks in real-world deployment, we propose an Active Adaption Resampling (AAR) method, which can better discover the distribution of unseen sample data and adapt the parameters of encoder. Experimental results show that our model outperforms the state-of-the-art semi-supervised attack detection methods with a 3% improvement in classification accuracy and a 90% reduction in training time.