Andresini, G;
Pendlebury, F;
Pierazzi, F;
Loglisci, C;
Appice, A;
Cavallaro, L;
(2021)
INSOMNIA: Towards Concept-Drift Robustness in Network Intrusion Detection.
In:
AISec '21: Proceedings of the 14th ACM Workshop on Artificial Intelligence and Security.
Association for Computing Machinery: Virtual, Republic of Korea.
Preview |
Text
insomnia.pdf - Published Version Download (1MB) | Preview |
Abstract
Despite decades of research in network traffic analysis and incredible advances in artificial intelligence, network intrusion detection systems based on machine learning (ML) have yet to prove their worth. One core obstacle is the existence of concept drift, an issue for all adversary-facing security systems. Additionally, specific challenges set intrusion detection apart from other ML-based security tasks, such as malware detection. In this work, we offer a new perspective on these challenges. We propose INSOMNIA, a semi-supervised intrusion detector which continuously updates the underlying ML model as network traffic characteristics are affected by concept drift. We use active learning to reduce latency in the model updates, label estimation to reduce labeling overhead, and apply explainable AI to better interpret how the model reacts to the shifting distribution. To evaluate INSOMNIA, we extend TESSERACT - a framework originally proposed for performing sound time-aware evaluations of ML-based malware detectors - to the network intrusion domain. Our evaluation shows that accounting for drifting scenarios is vital for effective intrusion detection systems.
Type: | Proceedings paper |
---|---|
Title: | INSOMNIA: Towards Concept-Drift Robustness in Network Intrusion Detection |
Event: | ACM Workshop on Artificial Intelligence and Security (AISec '21) |
Dates: | 15 November 2021 - 15 November 2021 |
ISBN-13: | 9781450386579 |
Open access status: | An open access version is available from UCL Discovery |
DOI: | 10.1145/3474369.3486864 |
Publisher version: | https://doi.org/10.1145/3474369.3486864 |
Language: | English |
Additional information: | This version is the author accepted manuscript. For information on re-use, please refer to the publisher’s terms and conditions. |
UCL classification: | UCL UCL > Provost and Vice Provost Offices > UCL BEAMS UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science |
URI: | https://discovery.ucl.ac.uk/id/eprint/10138832 |
Archive Staff Only
![]() |
View Item |