Adaptive Clustering-based Malicious Traffic Classification at the Network Edge

Alec F. Diallo, Paul Patras

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract / Description of output

The rapid uptake of digital services and Internet of Things (IoT) technology gives rise to unprecedented numbers and diversification of cyber attacks, with which commonly-used rule-based Network Intrusion Detection Systems (NIDSs) are struggling to cope. Therefore, Artificial Intelligence (AI) is being exploited as second line of defense, since this methodology helps in extracting non-obvious patterns from network traffic and subsequently in detecting more confidently new types of threats. Cybersecurity is however an arms race and intelligent solutions face renewed challenges as attacks evolve while network traffic volumes surge. In this paper, we propose Adaptive Clustering-based Intrusion Detection (ACID), a novel approach to malicious traffic classification and a valid candidate for deployment at the network edge. ACID addresses the critical challenge of sensitivity to subtle changes in traffic features, which routinely leads to misclassification. We circumvent this problem by relying on low-dimensional embeddings learned with a lightweight neural model comprising multiple kernel networks that we introduce, which optimally separates samples of different classes. We empirically evaluate our approach with both synthetic and three intrusion detection datasets spanning 20 years, and demonstrate ACID consistently attains 100% accuracy and F1-score, and 0% false alarm rate, thereby significantly outperforming state-of-the-art clustering methods and NIDSs.
Original languageEnglish
Title of host publicationIEEE INFOCOM 2021 - IEEE Conference on Computer Communications
PublisherInstitute of Electrical and Electronics Engineers (IEEE)
Number of pages10
ISBN (Electronic)978-1-6654-0325-2
ISBN (Print)978-1-6654-3131-6
DOIs
Publication statusPublished - 26 Jul 2021
Event2021 IEEE International Conference on Computer Communications - Virtual Conference
Duration: 10 May 202113 May 2021
https://infocom2021.ieee-infocom.org/

Publication series

Name
ISSN (Print)0743-166X
ISSN (Electronic)2641-9874

Conference

Conference2021 IEEE International Conference on Computer Communications
Abbreviated titleINFOCOM 2021
CityVirtual Conference
Period10/05/2113/05/21
Internet address

Keywords / Materials (for Non-textual outputs)

  • network intrusion detection
  • kernel-based clustering
  • deep learning

Fingerprint

Dive into the research topics of 'Adaptive Clustering-based Malicious Traffic Classification at the Network Edge'. Together they form a unique fingerprint.

Cite this