OIDMD: A Novel Open-Set Intrusion Detection Method Based on Mahalanobis Distance
Yunhui Liu, Angxiao Zhao, Lei Du, Chenhui Zhang, Hao Yan, Zhaoquan Gu · 2023
Intrusion detection has been a classic and challenging problem since new attacks emerge rapidly. Traditional methods are normally divided into two categories, anomaly detection and close-set detection. Anomaly detection methods cannot provide detailed diagnostic information about attacks, while close-set detection methods cannot cope with the constantly appearing unknown attacks. However, in real-world scenarios, intrusion detection methods have to detect known attacks while also identifying unknown ones. This is called open-set recognition which means that the detection model encounters unknown attacks that do not appear in the train phase. Some researchers have proposed open-set recognition methods to address the problem, but these methods are mainly based on Euclidean distance, which has two problems: (1) not taking into account the different scales of different feature (dimension) changes; (2) not considering the correlation between features. In this paper, we propose OIDMD that solves the open-set intrusion recognition based on the Mahalanobis distance. We conduct fine-grained attack classification of known attacks. Also, we conduct extensive experiments on the CICIDS2017 dataset and the results show that OIDMD outperforms existing methods for identifying unknown attacks, which confirms the effectiveness of open-set intrusion detection based on the Mahalanobis distance.