Knowledge-Based Zero-Touch Security under Host and Network Flow Features Merger
Yu Shen, Murat Şimşek, Burak Kantarcı, Hussein Talaat Mouftah, Mehran Bagheri, Petar Djukic · 2023
Incorporating machine learning algorithms with Intrusion Detection System (IDS) can detect network intrusions without human intervention and aims for Zero Touch Networks (ZTN). In this research, an automatic network-based features and host-based features integrated intrusion detection scheme is presented to improve the performance of network attack detection under the SCVIC-CIDS-2021 dataset which is derived from the integration of network packets and host logs of the CSE-CIC-IDS2018 dataset. Auto-encoder (AE) and Gated Recurrent Unit (GRU) are utilized for feature derivation to overcome the dimensionality mismatch between network-based and host-based features. The knowledge-based Prior Knowledge Input (PKI) model is used to combine unsupervised extra knowledge with a pre-trained supervised model for the final classification results. The results of the experiment reveal that the integration of network-based and host-based features is effective and the PKI model improves the performance of the original ML classification algorithm as well. Under the test set, the maximum achievable macro average F1-score reaches up to 97.08% which points out approximately 9% improvement compared to the best baseline performance.