skip to main content
10.1145/3190619.3190637acmotherconferencesArticle/Chapter ViewAbstractPublication PageshotsosConference Proceedingsconference-collections
research-article

Robustness of deep autoencoder in intrusion detection under adversarial contamination

Published: 10 April 2018 Publication History

Abstract

The existing state-of-the-art in the field of intrusion detection systems (IDSs) generally involves some use of machine learning algorithms. However, the computer security community is growing increasingly aware that a sophisticated adversary could target the learning module of these IDSs in order to circumvent future detections. Consequently, going forward, robustness of machine-learning based IDSs against adversarial manipulation (i.e., poisoning) will be the key factor for the overall success of these systems in the real world. In our work, we focus on adaptive IDSs that use anomaly-based detection to identify malicious activities in an information system. To be able to evaluate the susceptibility of these IDSs to deliberate adversarial poisoning, we have developed a novel framework for their performance testing under adversarial contamination. We have also studied the viability of using deep autoencoders in the detection of anomalies in adaptive IDSs, as well as their overall robustness against adversarial poisoning. Our experimental results show that our proposed autoencoder-based IDS outperforms a generic PCA-based counterpart by more than 15% in terms of detection accuracy. The obtained results concerning the detection ability of the deep autoencoder IDS under adversarial contamination, compared to that of the PCA-based IDS, are also encouraging, with the deep autoencoder IDS maintaining a more stable detection in parallel to limiting the contamination of its training dataset to just bellow 2%.

References

[1]
Kantchelian, A., Afroz, S., Huang, L., Islam, A.C., Miller, B., Tschantz, M.C., Greenstadt, R., Joseph, A.D., Tygar, J.: Approaches to adversarial drift. In: Proceedings of the 2013 ACM workshop on Artificial intelligence and security, ACM (2013) 99--110
[2]
Huang, L., Joseph, A.D., Nelson, B., Rubinstein, B.I., Tygar, J.: Adversarial machine learning. In: Proceedings of the 4th ACM workshop on Security and artificial intelligence, ACM (2011) 43--58
[3]
Hodo, E., Bellekens, X., Hamilton, A., Tachtatzis, C., Atkinson, R.: Shallow and deep networks intrusion detection system: A taxonomy and survey. arXiv preprint arXiv:1701.02145 (2017)
[4]
Ghorbani, A.A., Lu, W., Tavallaee, M.: Network intrusion detection and prevention: concepts and techniques. Volume 47. Springer Science & Business Media (2009)
[5]
Liao, H.J., Lin, C.H.R., Lin, Y.C., Tung, K.Y.: Intrusion detection system: A comprehensive review. Journal of Network and Computer Applications 36(1) (2013) 16--24
[6]
Kim, G., Yi, H., Lee, J., Paek, Y., Yoon, S.: Lstm-based system-call language modeling and robust ensemble method for designing host-based intrusion detection systems. arXiv preprint arXiv:1611.01726 (2016)
[7]
Vasilomanolakis, E., Karuppayah, S., Mühlhäuser, M., Fischer, M.: Taxonomy and survey of collaborative intrusion detection. ACM Computing Surveys (CSUR) 47(4) (2015) 55
[8]
Garcia-Teodoro, P., Diaz-Verdejo, J., Maciá-Fernández, G., Vázquez, E.: Anomaly-based network intrusion detection: Techniques, systems and challenges. computers & security 28(1) (2009) 18--28
[9]
Buczak, A.L., Guven, E.: A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys & Tutorials 18(2) (2016) 1153--1176
[10]
Kandhari, R., Chandola, V., Banerjee, A., Kumar, V., Kandhari, R.: Anomaly detection. Comput. Surveys 41(3) (2009) 1--6
[11]
Sommer, R., Paxson, V.: Outside the closed world: On using machine learning for network intrusion detection. In: Security and Privacy (SP), 2010 IEEE Symposium on, IEEE (2010) 305--316
[12]
Shyu, M.L., Chen, S.C., Sarinnapakorn, K., Chang, L.: A novel anomaly detection scheme based on principal component classifier. Technical report, DTIC Document (2003)
[13]
Ringberg, H., Soule, A., Rexford, J., Diot, C.: Sensitivity of pca for traffic anomaly detection. ACM SIGMETRICS Performance Evaluation Review 35(1) (2007) 109--120
[14]
Rubinstein, B.I., Nelson, B., Huang, L., Joseph, A.D., Lau, S.h., Rao, S., Taft, N., Tygar, J.: Stealthy poisoning attacks on pca-based anomaly detectors. ACM SIGMETRICS Performance Evaluation Review 37(2) (2009) 73--74
[15]
Rubinstein, B.I., Nelson, B., Huang, L., Joseph, A.D., Lau, S.h., Rao, S., Taft, N., Tygar, J.: Antidote: understanding and defending against poisoning of anomaly detectors. In: Proceedings of the 9th ACM SIGCOMM conference on Internet measurement conference, ACM (2009) 1--14
[16]
Xiao, H., Biggio, B., Nelson, B., Xiao, H., Eckert, C., Roli, F.: Support vector machines under adversarial label contamination. Neurocomputing 160 (2015) 53--62
[17]
Javaid, A., Niyaz, Q., Sun, W., Alam, M.: A deep learning approach for network intrusion detection system. In: Proceedings of the 9th EAI International Conference on Bio-inspired Information and Communications Technologies (formerly BIONETICS), New York, NY, USA. Volume 35. (2015) 2126
[18]
Hawkins, S., He, H., Williams, G., Baxter, R.: Outlier detection using replicator neural networks. In: International Conference on Data Warehousing and Knowledge Discovery, Springer (2002) 170--180
[19]
Soulié, F.F., Robert, Y., Tchuente, M.: Automata networks in computer science: Theory and applications. Manchester University Press (1987)
[20]
Goodfellow, I., Bengio, Y., Courville, A.: Deep learning. MIT Press (2016)
[21]
Csáji, B.C.: Approximation with artificial neural networks. Faculty of Sciences, Etvs Lornd University, Hungary 24 (2001) 48
[22]
Cup, K.: Dataset. available at the following website http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html 72 (1999)
[23]
McHugh, J.: Testing intrusion detection systems: a critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratory. ACM Transactions on Information and System Security (TISSEC) 3(4) (2000) 262--294
[24]
Tavallaee, M., Bagheri, E., Lu, W., Ghorbani, A.A.: A detailed analysis of the kdd cup 99 data set. In: Computational Intelligence for Security and Defense Applications, 2009. CISDA 2009. IEEE Symposium on, IEEE (2009) 1--6
[25]
Kingma, D., Ba, J.: Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014)

Cited By

View all
  • (2024)Robustness benchmark for unsupervised anomaly detection modelsJUSTC10.52396/JUSTC-2022-016554:1(0103)Online publication date: 2024
  • (2024)A smart model integrating LSTM and XGBoost for improving IoT-enabled smart cities securityCluster Computing10.1007/s10586-024-04780-128:1Online publication date: 6-Nov-2024
  • (2023)Classification Auto-Encoder Based Detector Against Diverse Data Poisoning AttacksData and Applications Security and Privacy XXXVII10.1007/978-3-031-37586-6_16(263-281)Online publication date: 12-Jul-2023
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Other conferences
HoTSoS '18: Proceedings of the 5th Annual Symposium and Bootcamp on Hot Topics in the Science of Security
April 2018
163 pages
ISBN:9781450364553
DOI:10.1145/3190619
  • General Chairs:
  • Munindar Singh,
  • Laurie Williams,
  • Program Chairs:
  • Rick Kuhn,
  • Tao Xie
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

  • National Security Agency: National Security Agency

In-Cooperation

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 10 April 2018

Permissions

Request permissions for this article.

Check for updates

Qualifiers

  • Research-article

Conference

HoTSoS '18
Sponsor:
  • National Security Agency
HoTSoS '18: Symposium and Bootcamp
April 10 - 11, 2018
North Carolina, Raleigh

Acceptance Rates

Overall Acceptance Rate 34 of 60 submissions, 57%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)47
  • Downloads (Last 6 weeks)3
Reflects downloads up to 22 Feb 2025

Other Metrics

Citations

Cited By

View all
  • (2024)Robustness benchmark for unsupervised anomaly detection modelsJUSTC10.52396/JUSTC-2022-016554:1(0103)Online publication date: 2024
  • (2024)A smart model integrating LSTM and XGBoost for improving IoT-enabled smart cities securityCluster Computing10.1007/s10586-024-04780-128:1Online publication date: 6-Nov-2024
  • (2023)Classification Auto-Encoder Based Detector Against Diverse Data Poisoning AttacksData and Applications Security and Privacy XXXVII10.1007/978-3-031-37586-6_16(263-281)Online publication date: 12-Jul-2023
  • (2023)Poisoning-Attack Detection Using an Auto-encoder for Deep Learning ModelsDigital Forensics and Cyber Crime10.1007/978-3-031-36574-4_22(368-384)Online publication date: 16-Jul-2023
  • (2022)Make Data Reliable: An Explanation-powered Cleaning on Malware Dataset Against Backdoor Poisoning AttacksProceedings of the 38th Annual Computer Security Applications Conference10.1145/3564625.3564661(267-278)Online publication date: 5-Dec-2022
  • (2022)A Comparative Study of Various Intrusion Detections In Smart Cities Using Machine Learning2022 International Conference on IoT and Blockchain Technology (ICIBT)10.1109/ICIBT52874.2022.9807724(1-6)Online publication date: 6-May-2022
  • (2022)Data Poisoning Attacks against Autoencoder-based Anomaly Detection Models: a Robustness AnalysisICC 2022 - IEEE International Conference on Communications10.1109/ICC45855.2022.9838942(5427-5432)Online publication date: 16-May-2022
  • (2022)Adversarial Machine Learning: A Multilayer Review of the State-of-the-Art and Challenges for Wireless and Mobile SystemsIEEE Communications Surveys & Tutorials10.1109/COMST.2021.313613224:1(123-159)Online publication date: Sep-2023
  • (2022)Scope of machine learning applications for addressing the challenges in next‐generation wireless networksCAAI Transactions on Intelligence Technology10.1049/cit2.121147:3(395-418)Online publication date: 30-Jun-2022
  • (2022)Network Intrusion Detection System Based on an Adversarial Auto-Encoder with Few Labeled Training SamplesJournal of Network and Systems Management10.1007/s10922-022-09698-w31:1Online publication date: 7-Oct-2022
  • Show More Cited By

View Options

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Figures

Tables

Media

Share

Share

Share this Publication link

Share on social media