Network Intrusion Detection with Reconstruction-Based Evasion Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network intrusion anomaly detection systems are vulnerable to adversarial evasion attacks, leading to reduced accuracy and incorrect classification of malicious traffic as benign, and require extensive computing resources and time for retraining predictive models.
Innovation Solution
A two-stage detection process involving an automatic coding module and classification module to filter network traffic, using reconstruction error and distribution similarity thresholds to enhance the system's resistance to evasion attacks and improve trustworthiness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning is applied to improve intrusion detection accuracy, then the system can perform better analysis to discover known or unknown attacks, but the system becomes vulnerable to adversarial evasion attacks that significantly reduce detection accuracy
Solution Approach 1:
The patent introduces an automatic coding module as an intermediary between the input network traffic and the intrusion anomaly classification model. This module reconstructs the input traffic and calculates reconstruction errors, which serve as a mediator to detect adversarial examples before they reach the main classification model, thereby protecting the system's reliability while maintaining detection accuracy
Solution Approach 2:
The system performs preliminary detection by calculating reconstruction errors and distribution similarities before the main classification process. This preliminary action identifies and filters out adversarial examples early in the detection pipeline, preventing them from compromising the classification model and maintaining system reliability
2Reliability
If existing network intrusion detection techniques are used, then detection can be performed, but a large number of diverse samples are required to create valid sample data or event lists, consuming a lot of computing resources and time for continuous retraining
Solution Approach 1:
The automatic coding module enables the system to self-evaluate input traffic by reconstructing it and calculating reconstruction errors. This self-service mechanism allows the system to automatically identify adversarial examples without requiring extensive external sample data or manual retraining, reducing computing resource consumption while maintaining detection reliability
Solution Approach 2:
The patent changes the detection parameters by using reconstruction errors and distribution similarities as new evaluation metrics instead of relying solely on traditional classification outputs. This parameter change enables more efficient detection that requires fewer diverse samples and less continuous retraining, improving resource efficiency while maintaining detection capability
Data Source
AI summary
A network intrusion detecting system includes a network card configured to receive network traffic and a processor. The processor is configured to analyze the network traffic and extract traffic characteristics of the network traffic and confirm whether the network traffic is network traffic to be detected based on the traffic characteristics; input the network traffic to be detected into an automatic coding module to obtain a reconstructed sample and calculate a reconstruction error between the network traffic to be detected and the reconstructed sample; input the network traffic to be detected and the reconstructed sample respectively into at least one classification module and calculate a distribution similarity when the reconstruction error is less than a reconstruction error threshold; and input the network traffic to be detected into an intrusion anomaly classification model for network intrusion classification when the distribution similarity is less than a confidence distribution similarity threshold.