Network intrusion detection system for identifying known attack and unknown attack

Abstract

The invention discloses a network intrusion detection system for identifying known attacks and unknown attacks, which comprises a traffic collection module which is used for deploying a lightweight traffic capture engine, is established on tcpdump, captures original traffic in real time, applies a dynamic filtering strategy published by a controller through a secure RESTfu lAPI, and transmits the original traffic to a cloud server; the two-stage TS-FGED detection module comprises a first stage of extracting features from an initial data packet of each network flow by using multi-Gaussian variational auto-encoder (MGVAE) to realize early detection, and a second stage of re-evaluating the flow predicted to be benign in the first stage by using a variational auto-encoder (VAE) based on complete flow-level statistical features. During detection, in the first stage, the MGVAE is used for extracting features from an initial data packet to achieve early detection of known attacks, in the second stage, the VAE is used for re-evaluating the flow predicted to be benign in the first stage, the detection capacity of unknown attacks is improved, and the design not only ensures the efficiency of early detection, but also improves the detection accuracy of the unknown attacks. And the detection accuracy of unknown attacks is improved.

Description

Technical Field

[0001] This invention belongs to the field of network security, and in particular relates to a network intrusion detection system for identifying known and unknown attacks. Background Technology

[0002] Software-Defined Wide-Area Network (SD-WAN) is a new model that integrates the concept of software-defined networking into wide-area networks. It enables enterprises to dynamically modify network traffic routing and policies, enhancing the flexibility and efficiency of network management and optimization. However, in complex network environments, SD-WAN faces significant security threats, including known attacks such as port scanning and brute-force intrusion, as well as unknown attacks that pose potential risks to the network. To address these threats, anomaly-based Network Intrusion Detection Systems (NIDSs) have emerged as an important security defense mechanism. Specifically, NIDSs use machine learning to learn patterns from benign traffic to detect malicious behavior. However, these methods only perform coarse-grained binary classification, distinguishing only between benign and malicious traffic, without further differentiating between known and unknown attacks within the malicious category. In contrast, fine-grained classification that identifies unknown attacks and categorizes known attacks provides more targeted defense measures.

[0003] In intrusion detection, fine-grained attack classification, which involves not only classifying known attacks but also identifying unknown ones, is a hot research topic. Recent work has mainly explored two directions: methods based on Extreme Value Theory (EVT) and methods based on contrastive learning. Despite significant progress, existing methods still have obvious shortcomings.

[0004] First, due to network complexity, traffic often exhibits significant intra-class diversity and inter-class similarity, resulting in an irregular or even discrete distribution in the feature space. EVT-based methods focus on capturing the tail behavior of the data distribution, constructing decision boundaries for unknown attacks by modeling extreme biases of known traffic patterns to achieve fine-grained attack classification. However, these methods rely on traditional classification losses, such as cross-entropy loss, neglecting the impact of intra-class diversity and inter-class similarity on detection performance. Contrastive learning-based methods enhance inter-class separability by optimizing feature distances between different classes in the feature space and achieve fine-grained attack classification by calculating the distance between samples and known class centers. However, these methods emphasize enhancing inter-class separability while ignoring the impact of intra-class diversity. This irregular intra-class distribution increases the complexity of decision boundary construction, reducing the accuracy and generalization ability of attack detection.

[0005] Secondly, these methods focus on extracting flow-level statistical features by aggregating packet header information from the entire network flow to construct these features. While these features capture unique traffic patterns, they rely on flow termination, which can lead to critical detection delays, especially when the flow duration is too long or timeout settings are manipulated by adversaries. It is noteworthy that recent research indicates known attacks exhibit identifiable characteristics in the early stages of network flows. Existing work has proposed early detection methods for known attacks by analyzing the initial packets of network flows; however, these methods have significant limitations. First, they are designed for early detection of known attacks and determine the number of initial packets based on known traffic types, neglecting the existence of unknown attacks. In fine-grained classifications involving unknown attacks, they fail to adequately capture the behavioral characteristics of unknown attacks, thus reducing detection accuracy. For example, some unknown attacks employ feature mimicry strategies, making their initial packets resemble benign traffic to evade detection. Second, due to the limited number of packets, converting the raw features of the initial packets into a graph or image representation to enhance spatial feature extraction improves detection accuracy, but introduces additional conversion delays. Therefore, it is necessary to research a network intrusion detection system that can distinguish between known and unknown attacks. Summary of the Invention

[0006] The purpose of this invention is to address the problem of intra-class diversity in network traffic. This paper aims to constrain the feature distribution within each class to make it more compact. A Variational Autoencoder (VAE) is considered to map high-dimensional traffic features to a continuous latent space, and the originally irregular intra-class distribution is regularized to a Gaussian prior using Kullback-Leibler (KL) divergence. However, traditional VAEs impose a globally shared multivariate Gaussian prior across all classes, leading to overlapping latent representations and blurred distinguishing boundaries, which is particularly detrimental to fine-grained attack classification. To address this challenge, a multivariate Gaussian prior is proposed. The Multi-Gaussian Variational Autoencoder (MGVAE) enhances the latent space by assigning distributions to specific subclasses. In MGVAE, each known class is assigned an interdependent Gaussian distribution in the latent space, effectively constraining the position and distribution shape of each class and avoiding overlap between class distributions. Furthermore, to improve inter-class separability, a triple loss mechanism is introduced during training to explicitly optimize the relative distance between different classes. Overall, MGVAE simultaneously addresses the issues of intra-class diversity and inter-class similarity in network traffic, significantly improving classification performance.

[0007] To achieve early detection of fine-grained attack classification, a two-stage detection framework, TS-FGED, is proposed. In the first stage, the proposed MGVAE model extracts features from the initial packets of each network flow. To enhance the feature representation of limited packets, MGVAE incorporates temporal modeling through Attention-Based Gated Recurrent Units (GRU-Attention). This design enables MGVAE to directly capture sequential dependencies in the temporal domain, effectively avoiding the transformation delay introduced by existing methods that rely on spatial transformation. However, the number of initial packets is usually determined based on known traffic patterns and may not capture the behavioral characteristics of unknown attacks. Therefore, in the first stage, some unknown attacks may be incorrectly classified as benign. To mitigate this problem, the second stage further analyzes the traffic predicted as benign. Specifically, it extracts complete flow-level statistical features and uses VAE to re-evaluate the flow based on reconstruction errors. By jointly utilizing the temporal features of the initial packets and the statistical features of the entire flow, TS-FGED achieves early detection of both known and unknown attacks without compromising its ability to detect unknown attacks.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a network intrusion detection system for identifying known and unknown attacks, comprising:

[0009] Traffic collection module: Deploys a lightweight traffic capture engine built on top of tcpdump to capture raw traffic in real time. The application controller publishes dynamic filtering policies through a secure RESTful API. Two-stage TS-FGED detection module: First stage: Uses Multi-Gaussian Variational Autoencoder (MGVAE) to extract features from the initial packets of each network flow to achieve early detection. Second stage: For traffic predicted as benign in the first stage, uses Variational Autoencoder (VAE) to re-evaluate based on complete flow-level statistical features.

[0010] Preferably, the captured raw traffic is organized using a hash table, where each flow is uniquely identified by a 5-tuple (source / destination IP and port, and protocol). Upon receiving a packet, the system searches for existing flow table entries. If an entry exists, the packet is added to that entry; otherwise, a new flow entry is created.

[0011] Preferably, the dynamic filtering strategy is represented using Berkeley Packet Filter (BPF) syntax to exclude irrelevant packets and reduce noise.

[0012] Preferably, the first stage is as follows: the system determines a maximum observation window u based on historical traffic statistics, monitors the initial data packets of each flow, and once the traffic accumulates M packets within the window (M is derived from the analysis of known traffic patterns), feature extraction is triggered. For flows in u that fail to reach M data packets, their feature vectors are filled with -1 to ensure consistent dimensions. If the transmission is normal and there is no reordering, duplication, or loss, the focus is on extracting early behavioral patterns rather than transmission anomalies.

[0013] Preferably, the variational autoencoder (VAE) is a deep generative model based on an encoder-decoder architecture, which maps input data to a low-dimensional latent space represented by a probability distribution, and then reconstructs similar data by sampling from this distribution.

[0014] Preferably, the variational autoencoder (VAE) is specifically configured such that the encoder is parameterized by θ and outputs the mean μ and variance σ of an assumed Gaussian distribution. 2 The input x is transformed into a latent representation, and the latent variable z is obtained by reparameterizing z = μ + σ⊙ò, where ò is a random noise vector sampled from the standard normal distribution N(0,1), and ⊙ denotes element-wise multiplication. The decoder, parameterized by θ', reconstructs the input x from the sampled latent variable z. To effectively learn the latent representation and accurately reconstruct the input, the variational autoencoder (VAE) employs a combined loss function L. loss This function consists of reconstruction loss and KL divergence loss, and is defined as follows:

[0015]

[0016] Where q θ (z|x) represents the variational distribution (encoder) that approximates the true posterior distribution, p θ' (x|z) is the generator distribution (decoder) for reconstructing x given z, p(z) is the prior distribution of the latent variable, and the reconstruction loss is... Ensure that the reconstructed data x' is very similar to the input data x;

[0017] In practical applications, the reconstruction loss is usually expressed as the mean squared error (MSE), which is calculated using the following formula:

[0018]

[0019] The prior distribution p(z) is usually assumed to follow a standard normal distribution N(0,1), while the variational distribution q θ (z|x) is modeled as N(μ,σ) 2 The encoder outputs μ and σ. Under these assumptions, the KL divergence loss can be calculated as follows:

[0020]

[0021] Where N represents the dimension of the latent variable z, μ n and σ n These are the mean and standard deviation of the variational distribution along the nth dimension. Let represent the mean vector of class c along the nth dimension for a specific class.

[0022] Preferably, the Gaussian variational autoencoder MGVAE is specifically: in a standard VAE, the prior distribution p(z) is usually modeled as a single Gaussian distribution N(0,1), capturing the distinctive features of multiple traffic categories, including benign and various attack categories;

[0023] Suppose the traffic consists of C known classes, one of which represents benign traffic, and the remaining C-1 classes correspond to different types of malicious traffic. For each class c∈{1,2,...,C}, assign an independent prior distribution p. c (z), modeled as a Gaussian distribution N(μ) c ,1), where μ c Let represent the average vector associated with class c. This design ensures that each class has a unique class center in the latent space. Accordingly, the KL divergence loss of the Gaussian variational autoencoder MGVAE is reformulated to minimize the variational distribution q of the specific class. θ (z|x,c) and the corresponding prior distribution p c The difference between (z) is defined as

[0024]

[0025] Where N represents the dimension of the latent variable z, μ n and σ n These are the mean and standard deviation of the variational distribution along the nth dimension. Let represent the mean vector of class c along the nth dimension for a specific class.

[0026] During training, each input sample x (i.e. Figure 2 The feature representation shown is first generated by the encoder, which produces the mean μ, variance σ, and corresponding latent representation z. The KL divergence loss, as defined in equation (4), is -KL(q) θ (z∣x,c)‖p c (z) is then used to regularize z to its associated specific class of Gaussian distribution N(μ). c ,1), where μ c It is a learnable parameter. This class-dependent prior ensures that the latent representations of different classes are centered on different mean vectors μ. c This also regularizes the shape of each distribution. It's worth noting that μ c The dimension of z must match the dimension of z to ensure compatibility within the potential space.

[0027] Preferably, to further improve class separability, the Gaussian Variational Autoencoder (MGVAE) incorporates a triplet loss into the training objective. The triplet loss encourages inter-class divergence by forcing samples from different classes to be mapped further apart in the latent space, while keeping samples from the same class closer together. Formally, it is defined as...

[0028]

[0029] Where x + It is a positive sample of the same class as x, x - The input x consists of negative samples from different classes. f represents a fully connected layer, and ψ is a margin hyperparameter that enforces minimum separation between positive and negative sample pairs. The decoder then reconstructs the original input x from the latent representation z, minimizing the reconstruction loss (typically measured by MSE) to ensure fidelity between the input and the reconstructed output. In summary, Gaussian Variational Autoencoder (MGVAE) jointly optimizes the reconstruction loss, class-specific KL divergence loss, and triplet loss, improving data reconstruction capability and the discriminability of the latent representation. The combined objective loss function is Loss. sum Represented as:

[0030]

[0031] Furthermore, to accelerate convergence and improve the quality of the latent space, the Gaussian distribution center μ for each class is initialized during the pre-training phase. c Specifically, each training sample x is fed into a feedforward network to output an initial embedding. The network is trained using only triplet loss, which facilitates separation between classes in the latent space. After convergence, the center of each class is extracted as the initialized μ. c It is the average value of the potential representations belonging to this class.

[0032] To enhance feature extraction from a limited initial data set, the Gaussian Variational Autoencoder (MGVAE) combines a gated recurrent unit (GRU) with an attention mechanism to effectively capture temporal dependencies in sequential data. For example... Figure 4 As shown, each stream consists of m packets, where each packet is represented by a feature vector consisting of payload length, packet direction, packet arrival interval, and application layer protocol type. Since the application layer protocol type remains constant across all packets in the same stream, it can be processed uniformly. To alleviate the high-dimensional sparsity caused by one-hot encoding of a large number of protocol types, an embedding layer is used to project the protocol type values ​​into a low-dimensional space e, reducing memory consumption and computational overhead. The remaining features {x1, x2, ..., x...} m The data are arranged in group order and then fed into a GRU network to model temporal dependencies. GRU then...

[0033]

[0034] Where t∈{1,2,...,m} represents the time step, m corresponds to the total number of t (i.e., the number of data packets), and z t and r t These represent updating the door and resetting the door, respectively. It is a candidate hidden state, h t It is the hidden state at time step t, x t The input vector at time step t, [h t-1 ,x t ] represents vector concatenation, ⊙ represents vector multiplication, and W z W r W h These are the weight matrices used to calculate the update gate, reset gate, and candidate hidden states, respectively, resulting in the hidden state sequence {h1, h2, ..., h...}. m Furthermore, to capture key temporal features, an additive attention mechanism is used to assign different importance weights to each hidden state.

[0035]

[0036] Among them W a b a and v a These are trainable parameters, u t α represents the context vector at time step t. t Let m represent the attention weight at time step t, m correspond to the total number of packets at time step t, and v represent the resulting context vector of aggregated time information. Finally, the final hidden state h is... m The context vector v and the protocol embedding vector e are concatenated to form a joint representation h. joint ={h m ,v,e}. This joint representation is then passed through two fully connected layers to produce the mean vector μ and the variance vector σ, which together constitute the encoder's output.

[0037] After MGVAE is iteratively trained and converges on the controller, each known class is represented by an independent Gaussian distribution in the latent space. Similar samples cluster tightly around the center of their specific class, while heterogeneous samples exhibit large separation. Furthermore, MGVAE demonstrates strong reconstruction capabilities for samples within the distribution, producing low reconstruction errors. In contrast, samples outside the training distribution produce higher reconstruction errors because the model fails to capture their flow patterns. Figure 1 As shown, in the first stage of detection, the reconstruction error and the latent space distribution are analyzed.

[0038] Preferably, the incident Gaussian variational autoencoder (MGVAE) performs a fine-grained classification and detection process for unknown and known attacks as follows:

[0039] Given a test sample x test (k), the goal is to determine its class. Assume each known class c in the training set contains J. c The sample consists of j = {1, 2, ..., J} c The index is first obtained by using the encoder of the trained Gaussian variational autoencoder (MGVAE) model to obtain each training sample x. c The latent representation z of (j) c (j), then, for each training sample x in class c c (j), calculate its Mahalanobis distance S to the corresponding class center. c (j), to quantify its deviation from the distribution of a specific class in the latent space, Mahalanobis distance comprehensively considers the correlation between features and the shape of the data distribution, and can effectively measure the deviation of a sample from the class center. Formally, let Let z be the centroid of class c, and computed as the latent representation of all specific classes. c The mean of (j), and let Σ c The covariance matrix of these latent representations is defined by the Mahalanobis distance.

[0040]

[0041] Then, the distance sequence S for each class c c =[S c (1),...,S c [j),...] sorted in descending order, threshold δ for class c c It is selected based on the lower quantile of the sorted distance values, which is defined as δ. c =S c (r), where It is S c The r-th term, ρ, is the quantile (e.g., 0.05). The choice of quantile affects the trade-off between the false positive rate of benign traffic and the true positive rate of unknown attacks. Lower quantiles can effectively reduce the false positive rate, but also lead to a decrease in the true positive rate. Conversely, higher quantiles can increase the true positive rate of unknown attacks, but at the cost of a higher false positive rate.

[0042] Subsequently, for the test sample x test (k), and then use the trained GMVAE model again to generate its latent representation z. test (k) and reconstruct it into x rec(k) Calculate the reconstruction error MSE. If the reconstruction error exceeds a predefined threshold λ, the sample is classified as an unknown attack; otherwise, further analysis is performed in the latent space to determine its category. In the latent space, representations of the same category tend to cluster together, while representations of different categories are separated. This is achieved by analyzing x... test The distribution of (k) in the latent space can further enable the identification of unknown attacks and the classification of known attacks. Specifically, for each known class c, z is calculated. test (k) and centroid The Mahalanobis distance between the two sides is used to quantify the degree of deviation from the class distribution, and it is defined as:

[0043]

[0044] Choose Mahalanobis distance S c (k) The smallest class c min δ cmin It is class C min The threshold, if The sample is then considered an unknown attack; otherwise, it is classified as belonging to c. min The robustness of the detection model is effectively enhanced by utilizing both reconstruction error and latent space distribution.

[0045] Preferred,

[0046] The beneficial effects of this invention are as follows:

[0047] 1. By assigning a specific Gaussian distribution to each known category, MGVAE effectively constrains the position and distribution shape of each class, avoiding overlap between class distributions, thus solving the problems of intra-class diversity and inter-class similarity. The introduction of a triple loss mechanism (reconstruction loss, class-specific KL divergence loss, and triplet loss) further optimizes the relative distance between different classes and improves the discriminative power of features. The GRU-Attention structure can directly capture sequential dependencies in the temporal domain, effectively extracting temporal features from the initial data packet, and effectively avoiding the additional overhead caused by spatial transformation.

[0048] 2. In the first stage of detection, this invention utilizes MGVAE to extract features from the initial data packets, enabling early detection of known attacks. In the second stage, VAE is used to re-evaluate the traffic predicted as benign in the first stage, improving the detection capability for unknown attacks. By combining the temporal characteristics of the initial data packets and the statistical characteristics of the complete flow, TS-FGED achieves early detection of both known and unknown attacks without affecting the ability to detect unknown attacks. This design ensures both the efficiency of early detection and the accuracy of detecting unknown attacks, effectively solving the core problems in the prior art. Attached Figure Description

[0049] The invention will now be further described with reference to the accompanying drawings;

[0050] Figure 1 This is a detection framework diagram for the SD-WAN scenario of the present invention;

[0051] Figure 2 This is a feature representation diagram based on the initial data packet of the present invention;

[0052] Figure 3 This is an architecture diagram of the MGVAE model of the present invention;

[0053] Figure 4 This is a network structure diagram of the encoder in the MGVAE of this invention;

[0054] Figure 5 This is a graph showing the relationship between TPR_U and FPR for all methods in the experiments of this invention;

[0055] Figure 6 This is a visualization of the different classes in the latent space during the experiments of this invention;

[0056] Figure 7 This is a diagram of the enterprise network architecture for SD-WAN according to the present invention. Detailed Implementation

[0057] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0058] This detection framework is deployed in an SD-WAN environment, enabling early, fine-grained classification of known and unknown attacks. Traffic collection, processing, and online detection based on TS-FGED are performed on edge devices (Customer Premises Equipment, CPE). Simultaneously, the controller is responsible for attack defense, flow labeling, offline model training, and updates. The following sections provide a detailed description and analysis of the proposed detection framework.

[0059] Due to the openness and complex network environment of enterprise service centers, they have become primary targets for cyberattacks. Given that service centers host a large number of network services and applications, the resulting traffic patterns are highly complex, allowing attackers to utilize various methods to achieve different objectives. For example, Distributed Denial-of-Service (DDoS) attacks use botnets to send massive amounts of fake traffic to target servers, quickly exhausting bandwidth, computing, or storage resources, leading to service interruptions or system-wide paralysis. Brute-force attacks, especially targeting remote access services such as FTP and SSH, systematically try numerous username and password combinations to gain unauthorized access, resulting in sensitive data leaks or further network penetration. Web application attacks bypass authentication mechanisms by exploiting system vulnerabilities or injecting malicious code (such as SQL injection and cross-site scripting (XSS)). SQL injection tamperes with database queries to extract or modify sensitive information, while XSS injects harmful scripts into web pages to steal user session data or perform unauthorized operations. Furthermore, as cyberattack techniques continue to evolve, attackers are constantly developing new attack methods. These novel and unknown attacks are more covert, further exacerbating the security challenges faced by enterprise service centers.

[0060] To ensure the security of our enterprise service center, we designed a novel Network Intrusion Detection System (NIDS) as a key security mechanism for identifying and responding to malicious network activities. Specifically, by deploying NIDS on client devices (CPEs) that support customizable network management and traffic optimization, inbound traffic can be monitored in real time to detect malicious behavior. This deployment strategy not only protects core business systems within the internal network but also enhances the security of CPEs, preventing them from being exploited by attackers as potential entry points for intrusion. Overall, the implemented NIDS possesses several essential functionalities to ensure robust detection performance. During the traffic collection phase, the system filters out irrelevant packets and focuses on analyzing traffic directly relevant to security detection. During the traffic processing phase, the system extracts key features from network traffic to improve the real-time performance and accuracy of detection. Finally, in the intrusion detection phase, the system performs fine-grained classification of known and unknown attacks to help network administrators develop targeted and effective defense strategies.

[0061] Reference Figure 1 - Figure 7 A network intrusion detection system for identifying known and unknown attacks, comprising:

[0062] Traffic collection module: To perform continuous threat monitoring for SD-WAN, a lightweight traffic capture engine is deployed on the CPE, built on top of tcpdump, to capture raw traffic in real time. The application controller publishes dynamic filtering policies through a secure RESTful API.

[0063] Two-stage TS-FGED detection module: First stage: Uses multi-Gaussian variational autoencoder (MGVAE) to extract features from the initial packets of each network flow to achieve early detection; Second stage: For traffic predicted as benign in the first stage, uses variational autoencoder (VAE) to re-evaluate based on complete flow-level statistical features.

[0064] Raw traffic is captured and organized using a hash table, where each flow is uniquely identified by a 5-tuple (source / destination IP and port, and protocol). Upon receiving a packet, the system searches for existing flow table entries. If a packet exists, it is added to that entry; otherwise, a new flow entry is created.

[0065] The dynamic filtering strategy uses Berkeley Packet Filtering (BPF) syntax to exclude irrelevant packets and reduce noise.

[0066] The first stage is as follows: In our proposed two-stage TS-FGED framework, each stage corresponds to a different traffic processing mechanism. The first stage focuses on the characteristics of the initial data packets to achieve early detection. Specifically, the system determines a maximum observation window u based on historical traffic statistics and monitors the initial data packets of each flow. Once the traffic accumulates M packets within the window (M is derived from analysis of known traffic patterns), feature extraction is triggered. For flows in u that do not reach M packets, their feature vectors are padded with -1 to ensure dimensional consistency. If the transmission is normal, without reordering, duplication, or loss, the focus is on extracting early behavioral patterns rather than transmission anomalies. Considering that the original data packet structure spans multiple protocol layers, a selective feature extraction strategy is adopted to efficiently capture flow behavior. Access layer characteristics (e.g., MAC addresses) are excluded due to their environmental dependence and the possibility of introducing noise. To avoid inconsistencies caused by differences in TCP and UDP structures, transport layer fields are also omitted. Instead, feature selection focuses on the network and application layers, which provide more stable and informative behavioral indicators. Specifically, packet direction (1 for client-to-server, 0 for server-to-client) is used to detect asymmetric or unusual communication patterns. Payload length may indicate unusual spikes in attack traffic. Packet arrival intervals are typically regular in benign traffic but irregular in malicious traffic. Application layer protocol type (e.g., HTTP) is used to protect privacy instead of the original payload. While attackers may attempt to mimic legitimate protocols, perfectly replicating their structure and timing is difficult, and any deviation may indicate malicious activity. Figure 2 As shown, the features extracted from the initial M data packets are organized into a stream-level sequence representation. Each stream is uniquely identified by a 5-tuple, and the actual features integrate multiple layers of information such as payload length sequence, data packet direction sequence, data packet arrival interval sequence, and application layer protocol type.

[0067] However, relying solely on initial packets may not capture the full extent of unknown attack behavior, especially when they simulate benign traffic. To address this, in the second phase, flows classified as benign in the first phase are re-evaluated by extracting comprehensive flow-level statistical features, thus providing a more complete understanding of their behavior. Notably, this information is extracted using the NFStream tool.

[0068] like Figure 1 As shown, the proposed two-stage TS-FGED framework includes the proposed MGVAE model and a traditional VAE model. In the first stage, based on features extracted from the first M packets of each flow, the MGVAE model utilizes reconstruction error and latent space distribution distance to achieve early detection of known and unknown attacks. In the second stage, based on features extracted from complete traffic-level statistics, the VAE model utilizes reconstruction error to re-evaluate traffic classified as benign in the first stage. Since MGVAE is an improvement on VAE, the VAE model will be introduced first, followed by a detailed explanation of the modifications made in MGVAE.

[0069] Variational autoencoders (VAEs) are deep generative models based on an encoder-decoder architecture. They map input data to a low-dimensional latent space represented by a probability distribution and then reconstruct similar data by sampling from that distribution.

[0070] The variational autoencoder (VAE) is specifically defined as follows: the encoder is parameterized by θ and outputs the assumed Gaussian distribution with mean μ and variance σ. 2 The input x is transformed into a latent representation, and the latent variable z is obtained by reparameterizing z = μ + σ⊙ò, where ò is a random noise vector sampled from the standard normal distribution N(0,1), and ⊙ denotes element-wise multiplication. The decoder, parameterized by θ', reconstructs the input x from the sampled latent variable z. To effectively learn the latent representation and accurately reconstruct the input, the variational autoencoder (VAE) employs a combined loss function L. loss This function consists of reconstruction loss and KL divergence loss, and is defined as follows:

[0071]

[0072] Where q θ (z|x) represents the variational distribution (encoder) that approximates the true posterior distribution, p θ' (x|z) is the generator distribution (decoder) for reconstructing x given z, p(z) is the prior distribution of the latent variable, and the reconstruction loss is... Ensure that the reconstructed data x' is very similar to the input data x;

[0073] In practical applications, the reconstruction loss is usually expressed as the mean squared error (MSE), which is calculated using the following formula:

[0074]

[0075] The prior distribution p(z) is usually assumed to follow a standard normal distribution N(0,1), while the variational distribution q θ (z|x) is modeled as N(μ,σ) 2 The encoder outputs μ and σ. Under these assumptions, the KL divergence loss can be calculated as follows:

[0076]

[0077] Where N represents the dimension of the latent variable z, μ n and σ n These are the mean and standard deviation of the variational distribution along the nth dimension. Let represent the mean vector of class c along the nth dimension for a specific class.

[0078] Visual Advanced Arrays (VAEs) utilize reconstruction error as an indicator of deviation from learned benign behavior patterns, thus effectively detecting malicious activity. The effectiveness of VAE-based methods in this field has been validated by a large body of work. In our proposed TS-FGED framework, when the first-stage MGVAE model classifies certain flows as benign, a VAE-based strategy is employed in the second stage to re-evaluate these flows. Specifically, during the training phase, the VAE is trained to learn flow-level statistical features extracted from benign traffic. During the detection phase, attacks exhibiting significant reconstruction errors are identified as unknown attacks. Through this second-stage re-evaluation, the framework maintains the early detection capability of the first stage while effectively identifying unknown attacks missed in the first stage, enhancing the accuracy of unknown attack detection.

[0079] Gaussian Variational Autoencoder (MGVAE) specifically addresses the following: In standard VAEs, the prior distribution p(z) is typically modeled as a single Gaussian distribution N(0,1). However, in the first stage of TS-FGED, this model aims for fine-grained attack classification, requiring the capture of distinct features from multiple traffic categories, including benign and various attack types. A single Gaussian prior is insufficient to establish independent latent representations for different categories, leading to overlapping class distributions in the latent space. To address this limitation, an MGVAE model that fuses class-specific prior distributions is proposed.

[0080] Suppose the traffic consists of C known classes, one of which represents benign traffic, and the remaining C-1 classes correspond to different types of malicious traffic. For each class c∈{1,2,...,C}, assign an independent prior distribution p. c (z), modeled as a Gaussian distribution N(μ) c ,1), where μ cLet represent the average vector associated with class c. This design ensures that each class has a unique class center in the latent space. Accordingly, the KL divergence loss of the Gaussian variational autoencoder MGVAE is reformulated to minimize the variational distribution q of the specific class. θ (z|x,c) and the corresponding prior distribution p c The difference between (z) is defined as

[0081]

[0082] Where N represents the dimension of the latent variable z, μ n and σ n These are the mean and standard deviation of the variational distribution along the nth dimension. Represents the mean vector of class c along the nth dimension for a specific class;

[0083] During training, each input sample x (i.e. Figure 2 The feature representation shown is first generated by the encoder, which produces the mean μ, variance σ, and corresponding latent representation z. The KL divergence loss, as defined in equation (4), is -KL(q) θ (z∣x,c)‖p c (z) is then used to regularize z to its associated specific class of Gaussian distribution N(μ). c ,1), where μ c It is a learnable parameter. This class-dependent prior ensures that the latent representations of different classes are centered on different mean vectors μ. c This also regularizes the shape of each distribution. It's worth noting that μ c The dimension of z must match the dimension of z to ensure compatibility within the potential space.

[0084] To further enhance class separability, Gaussian Variational Autoencoder (MGVAE) incorporates triplet loss into its training objective. Triplet loss encourages inter-class divergence by forcing samples from different classes to be mapped further apart in the latent space, while keeping samples from the same class closer together. Formally, it is defined as...

[0085]

[0086] Where x + It is a positive sample of the same class as x, x -The input x consists of negative samples from different classes. f represents a fully connected layer, and ψ is a margin hyperparameter that enforces minimum separation between positive and negative sample pairs. The decoder then reconstructs the original input x from the latent representation z, minimizing the reconstruction loss (typically measured by MSE) to ensure fidelity between the input and the reconstructed output. In summary, Gaussian Variational Autoencoder (MGVAE) jointly optimizes the reconstruction loss, class-specific KL divergence loss, and triplet loss, improving data reconstruction capability and the discriminability of the latent representation. The combined objective loss function is Loss. sum Represented as:

[0087]

[0088] Furthermore, to accelerate convergence and improve the quality of the latent space, the Gaussian distribution center μ for each class is initialized during the pre-training phase. c Specifically, each training sample x is fed into a feedforward network to output an initial embedding. The network is trained using only triplet loss, which facilitates separation between classes in the latent space. After convergence, the center of each class is extracted as the initialized μ. c It is the average value of the potential representations belonging to this class.

[0089] To enhance feature extraction from a limited initial data set, the Gaussian Variational Autoencoder (MGVAE) combines a gated recurrent unit (GRU) with an attention mechanism to effectively capture temporal dependencies in sequential data. For example... Figure 4 As shown, each stream consists of m packets, where each packet is represented by a feature vector consisting of payload length, packet direction, packet arrival interval, and application layer protocol type. Since the application layer protocol type remains constant across all packets in the same stream, it can be processed uniformly. To alleviate the high-dimensional sparsity caused by one-hot encoding of a large number of protocol types, an embedding layer is used to project the protocol type values ​​into a low-dimensional space e, reducing memory consumption and computational overhead. The remaining features {x1, x2, ..., x...} m The data are arranged in group order and then fed into a GRU network to model temporal dependencies. GRU then...

[0090]

[0091] Where t∈{1,2,...,m} represents the time step, m corresponds to the total number of t (i.e., the number of data packets), and z t and r t These represent updating the door and resetting the door, respectively. It is a candidate hidden state, h t It is the hidden state at time step t, x t The input vector at time step t, [h t-1 ,x t] represents vector concatenation, ⊙ represents vector multiplication, and W z W r W h These are the weight matrices used to calculate the update gate, reset gate, and candidate hidden states, respectively, resulting in the hidden state sequence {h1, h2, ..., h...}. m Furthermore, to capture key temporal features, an additive attention mechanism is used to assign different importance weights to each hidden state.

[0092]

[0093] Among them W a b a and v a These are trainable parameters, u t α represents the context vector at time step t. t Let m represent the attention weight at time step t, m correspond to the total number of packets at time step t, and v represent the resulting context vector of aggregated time information. Finally, the final hidden state h is... m The context vector v and the protocol embedding vector e are concatenated to form a joint representation h. joint ={h m ,v,e}. This joint representation is then passed through two fully connected layers to produce the mean vector μ and the variance vector σ, which together constitute the encoder's output.

[0094] After MGVAE is iteratively trained and converges on the controller, each known class is represented by an independent Gaussian distribution in the latent space. Similar samples cluster tightly around the center of their specific class, while heterogeneous samples exhibit large separation. Furthermore, MGVAE demonstrates strong reconstruction capabilities for samples within the distribution, producing low reconstruction errors. In contrast, samples outside the training distribution produce higher reconstruction errors because the model cannot capture their flow patterns, such as... Figure 1 As shown, in the first stage of detection, the reconstruction error and latent space distribution are analyzed.

[0095] The incident Gaussian variational autoencoder (MGVAE) performs fine-grained classification and detection of unknown and known attacks as follows:

[0096] Given a test sample x test (k), the goal is to determine its class. Assume each known class c in the training set contains J. c The sample consists of j = {1, 2, ..., J} c The index is first obtained by using the encoder of the trained Gaussian variational autoencoder (MGVAE) model to obtain each training sample x. c The latent representation z of (j) c (j), then, for each training sample x in class cc (j), calculate its Mahalanobis distance S to the corresponding class center. c (j), to quantify its deviation from the distribution of a specific class in the latent space, Mahalanobis distance comprehensively considers the correlation between features and the shape of the data distribution, and can effectively measure the deviation of a sample from the class center. Formally, let Let z be the centroid of class c, and computed as the latent representation of all specific classes. c The mean of (j), and let Σ c The covariance matrix of these latent representations is defined by the Mahalanobis distance.

[0097]

[0098] Then, the distance sequence S for each class c c =[S c (1),...,S c [j),...] sorted in descending order, threshold δ for class c c It is selected based on the lower quantile of the sorted distance values, which is defined as δ. c =S c (r), where It is S c The r-th term, ρ, is the quantile (e.g., 0.05). The choice of quantile affects the trade-off between the false positive rate of benign traffic and the true positive rate of unknown attacks. Lower quantiles can effectively reduce the false positive rate, but also lead to a decrease in the true positive rate. Conversely, higher quantiles can increase the true positive rate of unknown attacks, but at the cost of a higher false positive rate.

[0099] Subsequently, for the test sample x test (k), and then use the trained GMVAE model again to generate its latent representation z. test (k) and reconstruct it into x rec (k) Calculate the reconstruction error MSE. If the reconstruction error exceeds a predefined threshold λ, the sample is classified as an unknown attack; otherwise, further analysis is performed in the latent space to determine its category. In the latent space, representations of the same category tend to cluster together, while representations of different categories are separated. This is achieved by analyzing x... test The distribution of (k) in the latent space can further enable the identification of unknown attacks and the classification of known attacks. Specifically, for each known class c, z is calculated. test (k) and centroid The Mahalanobis distance between the two sides is used to quantify the degree of deviation from the class distribution, and it is defined as:

[0100]

[0101] Choose Mahalanobis distance S c (k) The smallest class cmin δ cmin It is class C min The threshold, if The sample is then considered an unknown attack; otherwise, it is classified as belonging to c. min The robustness of the detection model is effectively enhanced by utilizing both reconstruction error and latent space distribution.

[0102] To achieve early detection of fine-grained attack classification, the TS-FGED framework employs a two-stage detection strategy consisting of an MGVAE-based early detection module and a VAE-based re-identification module. At any stage of TS-FGED, once malicious traffic is identified (through reconstruction error or Mahalanobis distance metric), the CPE immediately forwards attack information (including attack type and anomaly score) to the controller, enabling network administrators to implement appropriate defensive measures based on the specific attack type and corresponding anomaly score. For attack flows with high anomaly values, a buffer pool is maintained, and further manual analysis is performed to correctly label the traffic. Specifically, for unknown attacks, it is necessary to determine whether they are genuine new attacks or false positives caused by conceptual drift within benign traffic. For known attacks, it is necessary to correct misclassifications of unknown attacks caused by insufficient packet information in the early detection stage. Calculating the VAE reconstruction error based on the complete flow-level statistical characteristics of the corresponding attack type can still assist in achieving this goal. When the false positive rate exceeds a set threshold or the number of new attacks reaches a certain level, the administrator initiates a model update to adapt to constantly changing traffic patterns and newly emerging attack types.

[0103] In the experiments, the proposed method was evaluated using two intrusion detection datasets, CICIDS2017 and CICIDS2018. Both datasets provide CSV files containing flow-level statistical features and PCAP files containing raw traffic data. In the experimental design, we constructed three dataset scenarios, as shown in Table I. Scenario 1 focuses on the classification of known attacks (excluding unknown attacks), while scenarios 2 and 3 focus on fine-grained classification of known and unknown attacks. In scenario 2, the attack mechanisms of known and unknown attacks are different (e.g., Hulk is a DoS attack, while XSS is a web attack). In scenario 3, the attack mechanisms of known and unknown attacks are similar (e.g., SlowHTTPTest and Sloloris are both DoS attacks). Therefore, six different datasets were constructed. Each dataset includes a class of known benign traffic in addition to various attack types. In subsequent experiments, 50% of the samples from each dataset were randomly selected for training, and 20% were used for testing. Notably, unknown attacks were only included in the test set and were not involved in the training process.

[0104] Table I: Training and Test Set Settings

[0105]

[0106] Experimental Environment: All experiments were conducted on a workstation equipped with an Intel Core i7-11700 processor, 16GB RAM, and an NVIDIA GeForce GT1030 GPU, running the Windows operating system. The deep learning models were implemented using PyTorch in Python 3.8. Detailed information on all model hyperparameters is summarized in Table II.

[0107] Table II: Hyperparameter Settings

[0108]

[0109] Evaluation Metrics: To evaluate the classification performance of the proposed method, four commonly used evaluation metrics were employed: Precision, Accuracy, Recalculation, and F1-score. To ensure fair evaluation across all categories, macro-averages of each metric (e.g., Precision, Recalculation, and F1-score) were used in subsequent experiments. Additionally, three binary classification metrics were employed. The False Positive Rate (FPR) measures the proportion of benign traffic misclassified as attacks, the True Positive Rate for Unknown Attacks (TPR_U) quantifies the proportion of unknown attacks correctly identified, and the False Negative Rate for Unknown Attacks (FNR_U) reflects the proportion of unknown attacks misclassified as benign traffic.

[0110] Methodology: First, to evaluate the effectiveness of the proposed MGVAE in fine-grained attack classification, it was compared with several state-of-the-art baseline methods. These methods included EVT-based methods such as CVAE-EVT, OpenMax, EVM, and W-SVM, as well as contrastive learning-based methods such as RFG_HELAD, CADE, and CADE-CL. For a fair comparison, the clustering module in the original CADE-EVT was removed during training, and the adversarial training component in RFG_HELAD was excluded. Since all baseline methods rely on full-scale statistical features, the GRU-Attention architecture in MGVAE was replaced with a DNN, and the stream-scale statistical features were used as input to ensure consistency in the evaluation settings. Second, to evaluate the effectiveness of the proposed MGVAE and TS-FGED in achieving early detection based on initial packets, experiments were conducted from two perspectives. On the one hand, the early detection performance of MGVAE was evaluated in the case of known attack classification (i.e., no unknown attacks). Two types of baseline methods were selected for comparison. The first category includes representative methods based on full-level statistical feature representations, such as DNN, XGBoost, Spearman-ensemble, CFS-BA-ensemble, GWO-PSO-RF, and GNN-NIDS. The second category consists of state-of-the-art early detection methods, including Graph2vec-RFSPIN-IDS. To ensure a fair comparison with the proposed MGVAE, the original classifiers in Graph2vec-RF and SPIN-IDS were replaced with MGVAE(DNN) and MGVAE(CNN), respectively, resulting in Graph2vec-MGVAE(DNN) and SPIN-MGVAE(CNN). Notably, all baseline methods are only applicable to detecting known attacks. On the other hand, the early detection performance of the TS-FGED(MGVAE+VAE) framework was evaluated in a fine-grained attack classification that includes both known and unknown attacks. Two classes of optimal baseline methods were selected for comparison, and their effectiveness was validated in subsequent experiments. The first class, MGVAE(DNN) based on full-level statistical features, serves as an ideal upper bound. The second type is MGVAE based on initial data packets, which is designed to detect known attacks at an early stage and does not involve unknown attacks.

[0111] Performance of Fine-Grained Attack Classification Methods in Known Attack Classification: To evaluate the feature extraction and classification capabilities of fine-grained attack classification methods, we conducted experiments on Scenario 1 of the CICIDS2017 and CICIDS2018 datasets. Detailed results are shown in Tables III and IV. Standard evaluation metrics, including accuracy, precision, F1 score, and recall, are reported. The results show that the contrastive learning-based method (below the dashed line) outperforms the EVT-based method (above the dashed line) on most evaluation metrics, particularly precision. For example, as shown in Table III, even the lowest precision among the contrastive learning-based methods (CADE 0.907) surpasses the highest precision among the EVT-based methods (OpenMax 0.897). This highlights the advantage of contrastive learning in learning discriminative feature representations of similar traffic patterns. Specifically, contrastive learning effectively enhances inter-class separability in the embedding space by encouraging similar traffic to cluster together while pushing different traffic away. Therefore, the model can form clearer and more accurate decision boundaries. In contrast, EVT-based methods primarily rely on traditional classification losses. For example, OpenMax uses the standard cross-entropy loss, which does not impose explicit constraints on feature similarity. Therefore, the learned feature representations lack significant distinguishability, leading to blurred inter-class boundaries and reducing the ability to distinguish similar traffic flows.

[0112] Table III: Performance Comparison of Fine-Grained Attack Classification Methods on CICIDS2017 (Scenario 1)

[0113]

[0114] Table IV: Performance Comparison of Fine-Grained Attack Classification Methods on CICIDS2018 (Scenario 1)

[0115]

[0116] Performance of MGVAE(DNN) in Fine-Grained Attack Classification: To evaluate the effectiveness of the proposed MGVAE(DNN) in fine-grained attack classification, we conducted experiments on scenarios 2 and 3 of the CICIDS2017 and CICIDS2018 datasets. Detailed results are shown in Tables V and VI. We first focus on standard evaluation metrics, including Precision, Accuracy, F1-score, and Recalculation, which comprehensively evaluate all categories. For EVT-based benchmark methods (above the dashed line), the detection of unknown attacks is achieved through score calibration, typically by fitting a Weibull distribution to the output scores of known categories. Traditional machine learning methods (e.g., W-SVM and EVM) outperform deep learning-based methods (e.g., CVAE-EVT and OpenMax) on most evaluation metrics, particularly in terms of accuracy. For example, as shown in Table V for scenario 2, even the lowest accuracy of CVAE-EVT (0.861) surpasses the highest accuracy of W-SVM (0.748). This performance gap can be attributed to the limited representational power of shallow models when handling high-dimensional flow features. For contrastive learning-based methods (below the dashed line), the class of a sample is determined by utilizing the distance between the test sample and the centroid of known classes in the latent space. Among these benchmark methods, CADE enforces inter-class separability through contrastive loss, while CADE-CL enforces it through centroid loss. Despite the different loss functions, their performance is similar because they both consistently emphasize inter-class separability. In contrast, RFG-HELAD performs better because it not only strengthens inter-class separability through contrastive loss but also attempts to capture the distribution of unknown attacks.

[0117] Table V: Performance comparison of the proposed MGVAE (DNN) and fine-grained detection benchmark methods on CICIDS 2017.

[0118]

[0119] Table VI: Performance comparison of the proposed MGVAE (DNN) and fine-grained detection benchmark methods on CICIDS 2018.

[0120]

[0121] To further evaluate the performance of these methods under benign traffic and unknown attack scenarios, we used the false positive rate (FPR) for benign traffic and the true positive rate (TPR_U) for unknown attacks. In our experiments, we observed a fundamental trade-off between pursuing a high TPR_U and maintaining a low FPR, depending on the decision threshold. In some methods, this leads to extreme results, making direct comparisons difficult. For example, as shown in Scenario 2 of Table VI, W-SVM achieves a relatively high TPR_U (0.725) at the cost of an unacceptably high FPR (0.225). To better visualize and compare the performance of different methods, Figure 5 The relationship between TPR_U and FPR for all methods is plotted, where (0, 1) represents the ideal point. Points closer to the top left corner indicate that while detecting unknown attacks, false positives of benign traffic are minimized, resulting in better performance.

[0122] As shown in Tables V and VI, and Figure 5 As shown, our proposed MGVAE(DNN) outperforms existing benchmark methods on most evaluation metrics. For EVT-based benchmark methods, the performance gap is primarily due to the fact that real-world unknown attacks may not conform to the strict assumptions of extreme value theory, such as specific tail distributions, which limits the generalization ability of EVT-based methods. For contrastive learning-based benchmark methods, the performance gap is mainly due to their neglect of intra-class diversity, which is common in real-world network traffic, especially benign traffic. Figure 6 As shown in (a), this figure illustrates the latent space learned by CADE. Although the spaces for different classes are separate, the intra-class distributions are irregular and dispersed, particularly in the benign class (blue). This dispersion weakens the effectiveness of distance-based classifiers, especially near the decision boundary. In contrast, our proposed MGVAE (DNN), such as Figure 6 As shown in (b), intra-class compactness and inter-class separation are explicitly enforced by modeling the distribution of specific classes. Known classes are mapped into compact and nearly circular clusters, while unknown attacks tend to fall into sparse and unoccupied regions of the latent space, which contributes to more reliable detection. Figure 5 An interesting phenomenon is clearly visible in (a): the figure shows that the baseline method based on contrastive learning does not show an advantage in either of these two metrics, and even lags behind the EVT-based method, highlighting the importance of intra-class diversity modeling. Furthermore, the TPR_U in scenario 2 is generally higher than that in scenario 3. This is mainly because the unknown attacks in scenario 2 are significantly different from the known attack categories, making them easier to distinguish. In contrast, the unknown attacks in scenario 3 are structurally similar to known categories, which increases the ambiguity of classification.

[0123] Performance evaluation of TS-FGED application for early detection in fine-grained known / unknown attack classification based on initial packet features.

[0124] The impact of the number of initial packets in each flow on MGVAE performance: To investigate the impact of the number of initial packets on detection performance, we evaluated MGVAE using packets of different lengths in Scenario 1 of CICIDS2017 and CICIDS2018. Detailed results are shown in Tables VII and VIII. The results show that in the early stages of traffic, the classification accuracy for all traffic types significantly improves with increasing packet count. However, once the number of packets exceeds a certain value (30 packets in Table VII and 40 packets in Table VIII), this improvement plateaus, and subsequent accuracy gains become negligible. This indicates that valuable discriminative information is embedded in the early stages of traffic, and MGVAE can effectively extract discriminative latent features from the initial packets. Interestingly, different traffic types exhibit varying sensitivities to packet count. For example, as shown in Table VII, attacks such as SSH-Patator and FTP-Patator achieve an accuracy of 1.000 using only 10 packets, indicating they have distinct early characteristics that allow them to be clearly distinguished from other traffic types. In contrast, as shown in Table VIII, attacks such as Slowloris, Goldeneye, and Hulk require at least 40 packets to achieve an accuracy of approximately 0.990. This is because they are all denial-of-service attacks with similar behavioral patterns, thus requiring more packets for reliable classification. This observation highlights the importance of selecting an optimal number of packets to balance detection performance across all traffic types. Too few packets may negatively impact detection accuracy for some attack types, while too many packets increase detection latency and computational overhead. Therefore, we determined the minimum number of packets required to ensure reliable detection of all known traffic types. Specifically, the optimal number of packets was set to 30 for CICIDS2017 and 40 for CICIDS2018. These values ​​were adopted in subsequent experiments.

[0125] Table VII: Impact of packet count on the accuracy of the proposed MGVAE for each traffic type on CICIDS2017 (Scenario 1)

[0126]

[0127] Table VIII: Impact of packet count on the accuracy of the proposed MGVAE for each traffic type in CICIDS2018 (Scenario 1)

[0128]

[0129] Performance Analysis of MGVAE in Early Detection of Known Attacks: To evaluate the early detection capability of MGVAE in known attack classification, we compared it with several state-of-the-art methods specifically designed for known attack detection. These comparisons were conducted in Scenario 1 of the CICIDS2017 and CICIDS2018 datasets. Detailed results are shown in Tables IX and X. Methods above the dashed line rely on full flow-level statistics, while methods below the dashed line are early detection methods based on initial packets of the flow. The results show that early detection methods using initial packets can achieve classification accuracy comparable to methods utilizing flow-level statistics, thus confirming the feasibility of early detection. Among the methods relying on full flow-level features, GNN-NIDS performed the worst, mainly because its dependence on graph structure makes it difficult to effectively learn flow-level statistics. Among the methods relying on initial packets, Graph2Vec-MGVAE (DNN) and SPIN-MGVAE (CNN) employ different spatial transformation techniques to enhance feature representation. Although these two methods are comparable to our proposed MGVAE in accuracy, they incur additional processing overhead due to the spatial transformation. Specifically, Graph2Vec transforms the sequence of payload length and orientation in the initial data packet into a graph structure and applies graph embedding techniques, while SPIN transforms the complete information sequence of the initial data packet into an image. Table XI provides a time comparison using 4500 samples from CICIDS2017. While Graph2Vec-MGVAE (DNN) achieves the fastest inference time (approximately 0.62 seconds) due to its DNN-based classifier, the spatial transformation stage introduces significant latency (5.692 seconds for graph construction and 15.418 seconds for graph embedding). Similarly, SPIN-MGVAE (CNN) requires 16.500 seconds to transform the data packet sequence into an image. These transformation times significantly exceed the inference time itself. In contrast, our proposed MGVAE extracts temporal features directly from the original data packet sequence during capture, without any spatial transformation. Overall, MGVAE achieves accuracy comparable to benchmark methods based on complete stream-level statistical features while significantly reducing the overall processing time.

[0130] Table IX: Performance comparison of the proposed MGVAE with known attack detection benchmarks on CICIDS2017 (Scenario 1)

[0131]

[0132] • Here, IDS * This refers to MGVAE (DNN), IDS + This refers to MGVAE (CNN).

[0133] Table X: Performance comparison of the proposed MGVAE with known attack detection benchmarks on CICIDS2018 (Scenario 1)

[0134]

[0135] • Here, IDS * This refers to MGVAE (DNN), IDS + This refers to MGVAE (CNN).

[0136] Table XI: Comparison of test times of the proposed MGVAE and earlier detection benchmark methods on CICIDS 2017 (Scenario 1, 4500)

[0137] (samples)

[0138]

[0139] • Here, IDS * This refers to MGVAE (DNN), IDS + This refers to MGVAE (CNN).

[0140] Performance Evaluation of TS-FGED in Early Detection of Fine-Grained Attack Classification: To evaluate the early detection performance of TS-FGED in fine-grained attack classification, we conducted experiments on scenarios 2 and 3 of the CICIDS2017 and CICIDS2018 datasets. Detailed results are shown in Tables XII and XIII. Because it utilizes complete flow-level statistical features, MGVAE(DNN) can capture more comprehensive traffic features and is considered an ideal upper bound benchmark for comparison. In contrast, MGVAE performs early detection based on a fixed number of initial packets, which leads to a significant decrease in the detection rate of unknown attacks and a corresponding drop in overall performance. This indicates that the number of initial packets determined based on known traffic types may be insufficient to effectively distinguish some unknown attacks from benign traffic, resulting in a higher false positive rate. Compared to MGVAE, TS-FGED significantly reduces FNR_U and increases TPR_U, thereby improving overall detection performance and achieving an accuracy comparable to MGVAE(DNN). This improvement can be attributed to the two-stage detection mechanism. After initial detection by MGVAE, VAE is used for secondary evaluation to reassess samples initially classified as benign. This method effectively improves the detection capability for unknown attacks without reducing the efficiency of early detection. Furthermore, comparing scenario 2 and scenario 3 shows that TPR_U is significantly lower in scenario 3. This is because the unknown attacks in scenario 3 have greater structural similarity to known attack types, leading to the unknown attacks being incorrectly classified as known attacks. This highlights the importance of manual analysis after the detection and defense phases, such as... Figure 1Step 8 in the model is shown to ensure accurate labeling and effective model retraining. Overall, the proposed two-stage TS-FGED framework achieves early detection without compromising detection rates against unknown attacks, while achieving accuracy comparable to MGVAE (DNN), which relies on complete streaming features.

[0141] Table XII: Performance comparison of the proposed TS-FGED and benchmark methods on CICIDS2017

[0142]

[0143] Table XIII: Performance comparison of the proposed TS-FGED and benchmark methods on CICIDS2018

[0144]

[0145] like Figure 7 The SD-WAN architecture features collaborative interaction between a centralized controller and CPEs. This configuration enables enterprises to securely connect branch offices over the public internet. The controller, with its powerful computing capabilities, is responsible for the centralized control and management of the entire network. It continuously collects real-time network status information from each CPE, formulates policies, and then distributes these policies back to the CPEs. CPEs are deployed at the network access points of branch offices, establishing direct connections to the external network and dynamically enforcing the policies received from the controller. Through the collaborative work of the controller and CPEs, SD-WAN provides an efficient, flexible, and cost-effective connectivity solution, effectively mitigating the limitations of traditional enterprise network architectures.

[0146] The above formulas are all derived from software simulation using a large amount of data, and are selected to be close to the actual values. The coefficients in the formulas are set by those skilled in the art based on the actual situation. The above are only preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or changes made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A network intrusion detection system for identifying known and unknown attacks, characterized in that, include: Traffic collection module: Deploys a lightweight traffic capture engine built on top of tcpdump to capture raw traffic in real time. The application controller publishes dynamic filtering policies through a secure RESTful API. Two-stage TS-FGED detection module: Stage 1: Uses Multi-Gaussian Variational Autoencoder (MGVAE) to extract features from the initial packets of each network flow to achieve early detection. Stage 2: For traffic predicted as benign in Stage 1, use Variational Autoencoder (VAE) to re-evaluate based on complete flow-level statistical features.

2. The network intrusion detection system for identifying known and unknown attacks according to claim 1, characterized in that, The captured raw traffic is organized using a hash table, where each flow is uniquely identified by a 5-tuple. Upon receiving a packet, the system searches for existing flow table entries. If an entry exists, the packet is added to that entry; otherwise, a new flow entry is created.

3. A network intrusion detection system for identifying known and unknown attacks according to claim 2, characterized in that, The dynamic filtering strategy is expressed using Berkeley Packet Filtering (BPF) syntax to exclude irrelevant packets and reduce noise.

4. A network intrusion detection system for identifying known and unknown attacks according to claim 1, characterized in that, The first stage is as follows: the system determines a maximum observation window u based on historical traffic statistics, monitors the initial data packets of each flow, and triggers feature extraction once the traffic accumulates M packets within the window. For flows in u that have not reached M data packets, their feature vectors are filled with -1 to ensure consistent dimensions. If the transmission is normal, the data packets are not reordered, duplicated, or lost.

5. A network intrusion detection system for identifying known and unknown attacks according to claim 1, characterized in that, The variational autoencoder (VAE) is a deep generative model based on an encoder-decoder architecture. It maps input data to a low-dimensional latent space represented by a probability distribution and then reconstructs similar data by sampling from this distribution.

6. A network intrusion detection system for identifying known and unknown attacks according to claim 5, characterized in that, The variational autoencoder (VAE) is specifically defined as follows: the encoder is parameterized by θ and outputs the assumed Gaussian distribution with mean μ and variance σ. 2 The input x is transformed into a latent representation, and the latent variable z is obtained by reparameterizing z = μ + σ⊙ò, where ò is a random noise vector sampled from the standard normal distribution N(0,1), and ⊙ denotes element-wise multiplication. The decoder, parameterized by θ', reconstructs the input x from the sampled latent variable z. To effectively learn the latent representation and accurately reconstruct the input, the variational autoencoder (VAE) employs a combined loss function L. loss This function consists of reconstruction loss and KL divergence loss, and is defined as follows: Where q θ (z|x) denotes the variational distribution that approximates the true posterior distribution, p θ' (x|z) is the generating distribution of reconstructed x given z, p(z) is the prior distribution of the latent variable, and the reconstruction loss is... Ensure that the reconstructed data x' is very similar to the input data x; In practical applications, the reconstruction loss is usually expressed as the mean squared error (MSE), which is calculated using the following formula: The prior distribution p(z) is usually assumed to follow a standard normal distribution N(0,1), while the variational distribution q θ (z|x) is modeled as N(μ,σ) 2 The encoder outputs μ and σ. Under these assumptions, the KL divergence loss can be calculated as follows: Where N represents the dimension of the latent variable z, μ n and σ n These are the mean and standard deviation of the variational distribution along the nth dimension. Let represent the mean vector of class c along the nth dimension for a specific class.

7. A network intrusion detection system for identifying known and unknown attacks according to claim 1, characterized in that, The Gaussian variational autoencoder MGVAE is specifically described as follows: In a standard VAE, the prior distribution p(z) is typically modeled as a single Gaussian distribution N(0,1), capturing distinctive features of multiple traffic categories, including benign and various attack categories. Suppose the traffic consists of C known classes, one of which represents benign traffic, and the remaining C-1 classes correspond to different types of malicious traffic. For each class c∈{1,2,...,C}, assign an independent prior distribution p. c (z), modeled as a Gaussian distribution N(μ) c ,1), where μ c Let represent the average vector associated with class c. Accordingly, the KL divergence loss of the Gaussian variational autoencoder (MGVAE) is reformulated to minimize the variational distribution q of the specific class. θ (z|x,c) and the corresponding prior distribution p c The difference between (z) is defined as Where N represents the dimension of the latent variable z, μ n and σ n These are the mean and standard deviation of the variational distribution along the nth dimension. Let represent the mean vector of class c along the nth dimension for a specific class.

8. A network intrusion detection system for identifying known and unknown attacks according to claim 7, characterized in that, The Gaussian variational autoencoder (MGVAE) also incorporates triplet loss into the training objective, which is defined as: Where x + It is a positive sample of the same class as x, x - The input x consists of negative samples from different classes. f represents a fully connected layer, and ψ is a margin hyperparameter that enforces minimum separation between positive and negative sample pairs. Subsequently, the decoder reconstructs the original input x from the latent representation z and minimizes the reconstruction loss. In summary, the Gaussian Variational Autoencoder (MGVAE) jointly optimizes the reconstruction loss, class-specific KL divergence loss, and triplet loss, combining the objective loss function Loss. sum Represented as: Gaussian Variational Autoencoder (MGVAE) combines a gated recurrent unit (GRU) with an attention mechanism. The GRU is based on: Where t∈{1,2,...,m} represents the time step, m corresponds to the total number of t (i.e., the number of data packets), and z t and r t These represent updating the door and resetting the door, respectively. It is a candidate hidden state, h t It is the hidden state at time step t, x t The input vector at time step t, [h t-1 ,x t ] represents vector concatenation, ⊙ represents vector multiplication, and W z W r W h These are the weight matrices used to calculate the update gate, reset gate, and candidate hidden states, respectively, resulting in the hidden state sequence {h1, h2, ..., h...}. m The additive attention mechanism is used to assign different importance weights to each hidden state. Among them W a b a and v a These are trainable parameters, u t α represents the context vector at time step t. t represents the attention weight at time step t, m corresponds to the total number of times t is passed, and v represents the resulting context vector of aggregated time information.

9. A network intrusion detection system for identifying known and unknown attacks according to claim 8, characterized in that, The Gaussian Variational Autoencoder (MGVAE) performs fine-grained classification and detection of unknown and known attacks as follows: Given a test sample x test (k), assuming each known class c in the training set contains J c The sample consists of j = {1, 2, ..., J} c The index is first obtained by using the encoder of the trained Gaussian variational autoencoder (MGVAE) model to obtain each training sample x. c The latent representation z of (j) c (j), then, for each training sample x in class c c (j), calculate its Mahalanobis distance S to the corresponding class center. c (j), in form, Denote the centroid of class c, and compute the latent representation z of all specific classes. c The mean of (j), and let Σ c The covariance matrix of these latent representations is defined by the Mahalanobis distance. Then, the distance sequence S for each class c c =[S c (1),...,S c [j),...] sorted in descending order, threshold δ for class c c It is selected based on the lower quantile of the sorted distance values, which is defined as δ. c =S c (r), where It is S c The r-th term, where ρ is the quantile; Subsequently, for the test sample x test (k), and then use the trained GMVAE model again to generate its latent representation z. test (k) and reconstruct it into x rec (k) Calculate the reconstruction error MSE. If the reconstruction error exceeds a predefined threshold λ, the sample is classified as an unknown attack; otherwise, further analysis is performed in the latent space to determine its category. In the latent space, representations of the same category tend to cluster together, while representations of different categories are separated. This is achieved by analyzing x... test The distribution of (k) in the latent space can further enable the identification of unknown attacks and the classification of known attacks. Specifically, for each known class c, z is calculated. test (k) and centroid The Mahalanobis distance between the two sides is used to quantify the degree of deviation from the class distribution, and it is defined as: Choose Mahalanobis distance S c (k) The smallest class, denoted as c min δ cmin It is class C min The threshold, if The sample is then considered an unknown attack; otherwise, it is classified as belonging to c. min kind.

Images