FOSS: Towards fine-grained unknown class detection against the open-set attack spectrum with variable legitimate traffic

• Main Authors: ZHAO, Ziming, LI, Zhaoxuan, XIE, Xiaofei, YU, Jiongchi, ZHANG, Fan, ZHANG, Rui, CHEN, Binbin, LUO, Xiangyang, HU, Ming, MA, Wenrui
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2024
• Subjects: Intrusion detection system; fine-grained unknown class detection; isolation forest; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/9363; https://ink.library.smu.edu.sg/context/sis_research/article/10363/viewcontent/FOSS_2024_av.pdf
• Institution: Singapore Management University

Anomaly-based network intrusion detection systems (NIDSs) are essential for ensuring cybersecurity. However, the security communities realize some limitations when they put most existing proposals into practice. The challenges are mainly concerned with (i) fine-grained unknown attack detection and (ii) ever-changing legitimate traffic adaptation. To tackle these problem, we present three key design norms. The core idea is to construct a model to split the data distribution hyperplane and leverage the concept of isolation, as well as advance the incremental model update. We utilize the isolation tree as the backbone to design our model, named FOSS, to echo back three norms. By analyzing the popular dataset of network intrusion traces, we show that FOSS significantly outperforms the state-of-the-art methods. Further, we perform an initial deployment of FOSS by working with the Internet Service Provider (ISP) to detect distributed denial of service (DDoS) attacks. With real-world tests and manual analysis, we demonstrate the effectiveness of FOSS to identify previously-unseen attacks in a fine-grained manner.