Drift-Aware Two-Step Network Intrusion Detection : Using Generative Representation Learning and Sequence-Based Anomaly Contamination

Sammanfattning

With society’s continuously increasing dependence on technology, the threat of cyberattacks is a pressing matter requiring the implementation of advanced security tools to protect critical digital infrastructures and data. However, developing effective attack detection tools is a challenging task due to the constantly evolving landscape of cyberthreats, with attacks increasing in both prevalence and complexity. In this thesis, we focus on one type of security tool, network intrusion detection systems, and propose a novel machine learning-based approach. To enhance the applicability of the method, we further consider two important but often neglected practical challenges associated with real network environments, the cost of obtaining labeled network data and the evolution of traffic patterns over time. In particular, the method proposed is based on unsupervised learning, and it incorporates strategies for efficient concept drift detection and adaptation. The key idea of the proposed approach is to prioritize capturing the most salient information encoded in the data, specifically using generative representation learning, spatio-temporal graph networks, and a sequence-based anomaly contamination strategy to detect network anomalies in two steps. The thesis also presents an experimental evaluation of the novel approach across two datasets and various concept drift scenarios. The approach outperforms the considered baselines in terms of multiple classification and practical metrics, specifically achieving up to 17.44% higher AUPRC than the top-performing baseline with 90.98% fewer model updates, suggesting that the design is a promising direction for continued research.