Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection

Abstract

Abstract-Neural networks have become an increasingly popular solution for network intrusion detection systems (NIDS). Their capability of learning complex patterns and behaviors make them a suitable solution for differentiating between normal traffic and network attacks. However, a drawback of neural networks is the amount of resources needed to train them. Many network gateways and routers devices, which could potentially host an NIDS, simply do not have the memory or processing power to train and sometimes even execute such models. More importantly, the existing neural network solutions are trained in a supervised manner. Meaning that an expert must label the network traffic and update the model manually from time to time.In this paper, we present Kitsune: a plug and play NIDS which can learn to detect attacks on the local network, without supervision, and in an efficient online manner. Kitsune's core algorithm (KitNET) uses an ensemble of neural networks called autoencoders to collectively differentiate between normal and abnormal traffic patterns. KitNET is supported by a feature extraction framework which efficiently tracks the patterns of every network channel. Our evaluations show that Kitsune can detect various attacks with a performance comparable to offline anomaly detectors, even on a Raspberry PI. This demonstrates that Kitsune can be a practical and economic NIDS.

Detecting Cyber Attacks in Industrial Control Systems Using Convolutional Neural Networks

“…Autoencoders have been used for anomaly and intrusion detection before [41], [42]. The differences between this work and [41] are that in our research (1) AEs are applied to raw physical signals without statistical feature extraction, and (2) AEs are applied to the frequency domain.…”

“…Autoencoders have been used for anomaly and intrusion detection before [41], [42]. The differences between this work and [41] are that in our research (1) AEs are applied to raw physical signals without statistical feature extraction, and (2) AEs are applied to the frequency domain. We extend the research in [42] by applying AEs to cyber attack detection in time series, combining control, status and raw physical data, as well as applying AEs to the frequency domain.…”

GEE: A Gradient-based Explainable Variational Autoencoder for Network Anomaly Detection

“…These models do not require labeled information and instead exploit the fact that anomalous behaviors tend to differ greatly from the standard or normal behavior of the network. Fiore et al [24] made use of discriminative restricted Boltzmann machine (RBM) for anomaly detection on network data; while Mirsky et al [25] proposed an ensembles of light-weight autoencoders for real time network intrusion detection, although their focus is on scalability of the system. Further, An and Cho [26] demonstrated that the VAE performs much better than AE and PCA on handwritten digit recognition and network intrusion detection.…”

“…However, the VAE model was trained using data labeled as normal, i.e., the anomalies are removed from training, which is difficult to do in practice. The above [24], [25], [26] are also known as semi-supervised learning.…”

Internet of Things Cyber Attacks Detection using Machine Learning

“…The domain of using machine learning has been extensively researched in the past [6], and several scholarly papers on intrusion detection by data-mining techniques and machine intelligence have been published [10]. However, most of these prior studies have only used machine learning techniques for intrusion detection in traditional networks.…”