Towards Autonomous Cybersecurity: An Intelligent AutoML Framework for Autonomous Intrusion Detection

TL;DR

This paper introduces an AutoML framework for autonomous intrusion detection in next-generation networks, automating data processing, model selection, and ensemble to enhance cybersecurity without manual intervention.

Contribution

It presents a comprehensive AutoML-based IDS framework that automates all key steps in the data analytics pipeline for autonomous cybersecurity in 5G and 6G networks.

Findings

Improved detection accuracy on benchmark datasets.

Automated pipeline reduces manual effort and expertise needed.

Enhanced performance over existing cybersecurity methods.

Abstract

The rapid evolution of mobile networks from 5G to 6G has necessitated the development of autonomous network management systems, such as Zero-Touch Networks (ZTNs). However, the increased complexity and automation of these networks have also escalated cybersecurity risks. Existing Intrusion Detection Systems (IDSs) leveraging traditional Machine Learning (ML) techniques have shown effectiveness in mitigating these risks, but they often require extensive manual effort and expert knowledge. To address these challenges, this paper proposes an Automated Machine Learning (AutoML)-based autonomous IDS framework towards achieving autonomous cybersecurity for next-generation networks. To achieve autonomous intrusion detection, the proposed AutoML framework automates all critical procedures of the data analytics pipeline, including data pre-processing, feature engineering, model selection, hyperparameter tuning, and model ensemble. Specifically, it utilizes a Tabular Variational Auto-Encoder (TVAE) method for automated data balancing, tree-based ML models for automated feature selection and base model learning, Bayesian Optimization (BO) for hyperparameter optimization, and a novel Optimized Confidence-based Stacking Ensemble (OCSE) method for automated model ensemble. The proposed AutoML-based IDS was evaluated on two public benchmark network security datasets, CICIDS2017 and 5G-NIDD, and demonstrated improved performance compared to state-of-the-art cybersecurity methods. This research marks a significant step towards fully autonomous cybersecurity in next-generation networks, potentially revolutionizing network security applications.