Search

The proliferation of novel attacks and growing amounts of data has caused practitioners in the field of network intrusion detection to constantly work towards keeping up with this evolving adversarial landscape. Researchers have been seeking to harness deep learning techniques in efforts to detect zero-day attacks and allow network intrusion detection systems to more efficiently alert network operators. The technique outlined in this work uses a one-class training process to shape autoencoder feature residuals for the effective detection of network attacks. Compared to an original set of input features, we show that autoencoder feature residuals are a suitable replacement, and often perform at least as well as the original feature set. This quality allows autoencoder feature residuals to prevent the need for extensive feature engineering without reducing classification performance. Additionally, it is found that without generating new data compared to an original feature set, using autoencoder feature residuals often improves classifier performance. Practical side effects from using autoencoder feature residuals emerge by analyzing the potential data compression benefits they provide. [ABSTRACT FROM AUTHOR]

In computer networks, denial-of-service (DoS) attacks attempt to make computers or network resources unavailable for their intended use. DoS attacks are difficult to detect and mitigate since they normally do not attempt to access the private data of their intended victim, but rather intend to disrupt the publicly available resources their victims provide. This article discusses methods for detecting and mitigating DoS attacks with a focus on techniques that leverage machine learning algorithms. Such algorithms promise to: (a) detect when computer services are being used in an adversarial fashion, (b) separate network traffic into nominal and anomalous components, and (c) provide opportunities for mitigating the attacks while maintaining the integrity of the effected services. The key ingredient of the ideas presented here is the use of correlations and dependencies in computer access patterns, and the larger context in which they exist, to separate the “wheat” – the real users of the services – from the “chaff” –the perpetrators who are attempting to disrupt the services. [ABSTRACT FROM AUTHOR]