Self-Supervised Learning for Cybersecurity Anomaly Detection

Seena K R

Vol. 7, Issue 1, Jan-Dec 2021

Page Number: 295 - 308

Abstract:

Cybersecurity systems deal with a huge amount of data like network traffic, system logs, user login records, and information from devices. Because of this, it's hard to monitor everything by hand or use old rules to catch security threats. Newer systems that use machine learning have shown promise, but most of them rely on labeled data, which is costly to create, quickly becomes outdated, and doesn't cover new or unknown attacks well. Self-supervised learning offers a better way. It learns from large amounts of data that hasn’t been labeled, using automatically created learning goals. Recent studies show that contrastive self-supervised learning can find unusual activity in encrypted network traffic without looking at the actual content of the packets. This research introduces a new framework called SS-CADF, which uses unlabeled traffic data to learn what normal and abnormal network behavior looks like. The framework will use several techniques: transforming features, learning patterns over time, contrastive learning, and scoring for anomalies. Features like packet size, how long a connection lasts, times between packets, the type of protocol used, and details about the source and destination will be used to build training examples. An encoder based on Transformer or LSTM models will create hidden representations of the data. Contrastive learning will help the model recognize similar and different traffic patterns. Then, an anomaly score will be calculated based on these representations. The framework will be tested using standard cybersecurity datasets such as CICIDS2017, UNSW-NB15, CIC-Darknet2020, and possibly encrypted traffic datasets. Its performance will be measured using accuracy, precision, recall, F1 score, ROC-AUC, PR-AUC, false-positive rate, and how well it detects new attacks. The goal is to create a scalable and efficient system that can find new and unknown attack patterns without needing labeled data.

References

• Aldweesh, A., Derhab, A., & Emam, A. Z. (2019). Deep learning approaches for anomalybased intrusion detection systems: A survey, taxonomy, and open issues. Knowledge-Based Systems, 189, 105124.
• Choi, H., Kim, M., Lee, G., & Kim, W. (2019). Unsupervised learning approach for network intrusion detection system using autoencoders. The Journal of Supercomputing, 75(9), 5597– 5621.
• Zhong, Y., Chen, W., Wang, Z., Chen, Y., Wang, K., Li, Y., Yin, X., Shi, X., Yang, J., & Li, K. (2019). HELAD: A novel network anomaly detection model based on heterogeneous ensemble learning. Computer Networks, 168, 107049.
• Lee, J. H., & Park, K. H. (2019). AE-CGAN model based high-performance network intrusion detection system. Applied Sciences, 9(20), 4221.
• Ergen, T., & Kozat, S. S. (2019). Unsupervised anomaly detection with LSTM neural networks. IEEE Transactions on Neural Networks and Learning Systems, 31(8), 3127–3141.
• Hsu, Y. F., He, Z. Y., Tarutani, Y., & Matsuoka, M. (2019). Toward an online network intrusion detection system based on ensemble learning. In 2019 IEEE International Conference on Cloud Computing (CLOUD) (pp. 174–178). IEEE.
• Hwang, R. H., Peng, M. C., Huang, C. W., Lin, P. C., & Nguyen, V. L. (2020). An unsupervised deep learning model for early network traffic anomaly detection. IEEE Access, 8, 30387– 30399.
• Verkerken, M., D’hooge, L., Wauters, T., Volckaert, B., & De Turck, F. (2020). Unsupervised machine learning techniques for network intrusion detection on modern data. In 2020 Fourth Cyber Security in Networking Conference (CSNet) (pp. 1–8). IEEE.
• Vaiyapuri, T., & Binbusayyis, A. (2020). Application of deep autoencoder as a one-class classifier for unsupervised network intrusion detection: A comparative evaluation. PeerJ Computer Science, 6, e327.

Back Download