Detecting Zero-Day Intrusion Attacks Using Semi-Supervised Machine Learning Approaches

Abstract

Recently, network intrusion attacks, particularly new unknown attacks referred to as zeroday attacks, have become a global phenomenon. Zero-day network intrusion attacks constitute a frequent cybersecurity threat, as they seek to exploit the vulnerabilities of a network system. Previous studies have demonstrated that zero-day attacks can compromise a network for prolonged periods if network traffic analysis (NTA) is not performed thoroughly and efficiently. NTA plays a crucial role in supporting machine learning (ML) based network intrusion detection systems (NIDS) by monitoring and extracting meaningful information from network traffic data. Network traffic data constitute large volumes of data described by features such as destination-to-source packet count. It is important to use only those features that have a significant impact on the performance of an NIDS. The problem is that most existing ML models for NIDS employ features such as Internet protocol (IP) addresses that are redundant for detecting zero-day attacks and therefore negatively impact the performance of these ML models. The solution proposed in this study demonstrates that the law of anomalous numbers, famously known as Benford's law, is a viable technique that can effectively identify significant network features that are indicative of anomalous behaviour and can be used for detecting zero-day attacks. Finally, our study illustrates that semi-supervised ML approaches are effective for detecting zero-day attacks if significant features are optimally chosen. The experimental results demonstrate that one-class support vector machines achieved the best results (Matthews correlation coefficient of 74% and F 1 score of 85%) for detecting zero-day network attacks.

A Lightweight Double-Stage Scheme to Identify Malicious DNS over HTTPS Traffic Using a Hybrid Learning Approach

“…According to the comparison stated in Table 2 , diverse learning models have been presented in the literature to address the problem of identifying malicious DoH. These include (but are not limited to) the long short-term memory (LSTM) based DoH identification model proposed by Davidson et al [ 38 ], the one class support vector machine (OCSVM) based DoH identification model proposed by Mbona et al [ 51 ], the Bidirectional-LSTM (Bi-LSTM) based DoH identification model proposed by X. Du et al [ 52 ], the ensemble learning of Decision trees (EL-DT) based DoH identification model proposed by Chijioke et al [ 53 ], the optimizable K-nearest neighbors (O-KNN) based model proposed by Al-Haija et at.…”

Simulation of SDN in mininet and detection of DDoS attack using machine learning

“…The main intention of UDP is to saturate the internet pipe. Zero-day flood [25] The "zero-day" used to describe all unknown attacks or new attacks exploiting vulnerabilities.…”

Machine Learning Research Trends in Africa: A 30 Years Overview with Bibliometric Analysis Review

“…Also, deep learning has been used to design security models that can be used on large-scale security datasets [ 125 ]. Mbona and Eloff [ 126 ] designed a semi-supervised machine learning approach to detect zero-day (new unknown) intrusion attacks based on the law of anomalous numbers to identify significant network features that effectively show anomalous behaviour. Similarly, Benlamine et al [ 127 ], used a machine learning model to evaluate emotional reactions in virtual reality environments where the face is hidden in a virtual reality headset, making facial expression detection using a webcam impossible.…”