Edge Intrusion Detection With TCN-GANs and Cloud Attack Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems (IDSs) face challenges in detecting distributed attacks, handling zero-day attacks without labeled data, and suffer from high false positive rates and long detection times, particularly due to the limitations of LSTM networks in computational complexity and memory usage.
Innovation Solution
A two-stage system using unsupervised anomaly detection (AD) modules based on Generative Adversarial Networks (GANs) with Temporal Convolutional Networks (TCN), Self-Attention, and Transformers, deployed on edge servers, and supervised anomaly classification (AC) on a cloud server, leveraging federated learning for model updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If LSTM networks are used to model time-dependencies in network traffic data, then the system can capture sequential patterns effectively, but computational complexity increases significantly and memory consumption rises due to storing partial results of multiple cell gates
Solution Approach 1:
The patent replaces the LSTM mechanical structure (sequential processing with multiple cell gates) with a TCN structure based on convolutional operations. The TCN uses dilated causal convolutions to capture temporal dependencies without the sequential processing bottleneck, substituting the recurrent mechanism with a parallelizable convolutional approach that maintains detection accuracy while reducing computational complexity
Solution Approach 2:
The patent segments the temporal modeling task into parallel convolutional operations with different dilation rates. Instead of using a single sequential LSTM process, the TCN divides temporal pattern recognition into multiple parallel convolutional layers, each handling specific temporal scales through dilated convolutions, enabling parallel computation while preserving sequential pattern detection capabilities
2Reliability
If LSTM networks are used to process network traffic data, then temporal dependencies can be captured, but detection time increases due to sequential processing requirements
Solution Approach 1:
The patent substitutes the sequential LSTM processing mechanism with parallel TCN-based convolutional operations. The TCN architecture allows simultaneous processing of multiple time steps through dilated causal convolutions, eliminating the sequential bottleneck while maintaining the ability to capture long-term temporal dependencies in network traffic patterns
Solution Approach 2:
The patent employs periodic dilated convolutions with increasing dilation rates across layers, creating a hierarchical temporal sampling pattern. This periodic structure allows the model to capture temporal dependencies at multiple scales simultaneously through parallel operations, reducing detection time while preserving accuracy
3Adaptability or versatility
If LSTM networks are deployed on devices with limited computational power, then the system can be deployed in resource-constrained environments, but performance deteriorates due to high computational requirements
Solution Approach 1:
The patent replaces the computationally intensive LSTM mechanism with the more efficient TCN architecture based on dilated causal convolutions. This substitution reduces the computational burden significantly, enabling deployment on edge devices with limited resources while maintaining or improving detection performance through parallelizable operations
Solution Approach 2:
The patent changes the fundamental processing parameters from sequential recurrent updates to parallel convolutional operations with configurable dilation rates. This parameter change transforms the computational complexity from linear to constant with respect to sequence length, making the system adaptable to resource-constrained environments without sacrificing detection capability
4Adaptability or versatility
If unsupervised IDS approaches are used to detect zero-day attacks without labeled data, then the system can detect unknown attacks, but false positive rates increase and detection times lengthen
Solution Approach 1:
The patent performs preliminary training of the TCN-based GAN model using only normal traffic data to establish a baseline of legitimate network behavior. This preliminary action creates a robust reference model that can identify deviations (potential attacks) without requiring labeled attack data, reducing false positives by establishing accurate normal patterns before deployment
Solution Approach 2:
The patent introduces a two-stage detection system where the TCN-based anomaly detector serves as an intermediary between raw network traffic and final detection decisions. The TCN extracts meaningful temporal features and the GAN model evaluates anomaly scores, creating an intermediate representation that reduces false positives by filtering out noise before final classification
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is provided a method for detecting cyber-attacks at edge servers. The method comprises receiving network traffic. The method comprises extracting and normalizing network flow features from the network traffic to produce a data pattern for evaluation. The method comprises computing an anomaly detection score for the data pattern for evaluation. The method comprises comparing the anomaly detection score with a threshold and determining if the network traffic corresponds to normal traffic or to an anomaly. The method comprises, upon determining that the network traffic corresponds to an anomaly, mitigating malicious network traffic by triggering a mitigation strategy and sending an anomaly message to an anomaly classifier. A method for classifying cyber-attacks at a cloud server is also provided.