Transfer Learning Method for Handling The Intrusion Detection System with Zero Attacks Using Machine Learning and Deep Learning
Talluri Upender, Bechoo Lal, Regonda Nagaraju · 2023
Due to the fast advancement of technology, cybercrime is also increasing in frequency and complexity. Since a variety of attacks evolves regularly with complex patterns and varied signatures the task of securing cyberspace becomes more and more difficult and challenging. To minimize the impact of cybercrime through early detection of intrusions, network activity in terms of network traffic, is monitored in real-time thus accumulating huge data which is sometimes erroneous. In order to create efficient security algorithms for attack detection, it is crucial to combine the principles of cybersecurity with data analytics. Known attacks are detected by the signature-based intrusion detection systems but the success of these systems heavily depends on feature engineering performed on the training data used to create attack signatures. In the context of Intrusion Detection Systems (IDS) most of the standard datasets have predominantly numeric data with a few categorical features and hence calls for the exploration of appropriate methods for handling the few categorical features to develop a successful intrusion detection system. Intruders aim to create zero-day attacks, which are entirely unheard-of, to avoid being discovered. The standard machine learning based intrusion detection systems won't initially catch zero-day assaults since there is a dearth of labelled data. Since, zero-day attacks are unknown attacks with ever-volving nature, it is very difficult to identify them, and also it is highly desirable to stop them. Zero-day attacks are handled in two different scenarios; the first scenario wherein minimal attack information is shared among the nodes of an Intrusion Detection Network (IDN) and the second scenario wherein there is no labeled information at all related to the zero-day attack.Three security-related concerns are the focus of this research project: (i) efficient detection of existing attacks, (ii) early detection of novel attacks, and (iii) detection of zero-day attacks. The research suggests using a transfer learning strategy in order to counter zero-day assaults. To handle the first case, inductive transfer learning is necessary, but transductive transfer learning is needed to provide a framework for intrusion detection in the second scenario. In the context of IDN, a transfer learning framework for the early identification of new assaults. The proposed transfer learning framework leverages the few labeled examples of a new attack shared among the collaborative nodes of an IDN for the detection of new attacks. Supervised Manifold Alignment methodology for Domain Unification is applied to circumvent the problem of heterogeneous feature spaces maintained by the different nodes of the IDN in the process of collaborative learning. Since, most of them are variants of existing attacks whose signatures are already recognized, in this thesis authors proposes a Deep transductive transfer learning framework that aims to apply transfer learning as it can transfer the knowledge that is acquired while learning signatures of known attacks for detecting of zero-day attacks. Unsupervised Manifold Alignment methodology for Domain Unification is proposed to transfer knowledge from source domain through cluster correspondence.