论文标题
网络和主机的协作特征图，用于AI驱动的入侵检测
Collaborative Feature Maps of Networks and Hosts for AI-driven Intrusion Detection
论文作者
论文摘要
入侵检测系统（ID）是关键的安全机制，可防止网络或主机上的各种网络威胁和恶意行为。由于已经广泛研究了基于网络的ID（NID）或基于主机的ID（HID），因此本文旨在提出一个集成网络和主机数据以提高IDS性能的组合入侵检测系统（CID）。由于包括包括网络数据包和主机数据的数据集的稀缺性，我们提出了一个新颖的CIDS数据集编队框架，该框架可以从各种操作系统和与网络流相对的日志实体中处理日志文件。一个名为SCVIC-CIDS-2021的新CIDS数据集是从众所周知的基准数据集（CIC-IDS-2018）中衍生出的，该数据集是通过使用所提出的框架来得出的。此外，提出了一个基于变压器的深度学习模型，它可以将网络流和主机功能作为输入和优于仅依赖网络流量功能的输入和优于基线模型。在SCVIC-CIDS-2021数据集中评估所提出的CIDS-NET的实验结果支持了将宿主和流量特征相结合的益处的假设，因为拟议的CIDS-NET可以将基线解决方案的宏F1得分提高6.36％（高达99.89％）。
Intrusion Detection Systems (IDS) are critical security mechanisms that protect against a wide variety of network threats and malicious behaviors on networks or hosts. As both Network-based IDS (NIDS) or Host-based IDS (HIDS) have been widely investigated, this paper aims to present a Combined Intrusion Detection System (CIDS) that integrates network and host data in order to improve IDS performance. Due to the scarcity of datasets that include both network packet and host data, we present a novel CIDS dataset formation framework that can handle log files from a variety of operating systems and align log entities with network flows. A new CIDS dataset named SCVIC-CIDS-2021 is derived from the meta-data from the well-known benchmark dataset, CIC-IDS-2018 by utilizing the proposed framework. Furthermore, a transformer-based deep learning model named CIDS-Net is proposed that can take network flow and host features as inputs and outperform baseline models that rely on network flow features only. Experimental results to evaluate the proposed CIDS-Net under the SCVIC-CIDS-2021 dataset support the hypothesis for the benefits of combining host and flow features as the proposed CIDS-Net can improve the macro F1 score of baseline solutions by 6.36% (up to 99.89%).
