Novelty Detection in Network Traffic: Using Survival Analysis for Feature Identification
No Thumbnail Available
Authors
Bradley, Taylor
Alhajjar, Elie
Bastian, Nathaniel D.
Issue Date
2023
Type
proceedings-article
Language
Keywords
Novelty detection , Network traffic , Cyber Attack , Machine Learning , Survival analysis
Alternative Title
Abstract
Network Intrusion Detection Systems (NIDS) are an important component of many organizations’ cyber defense, resiliency and assurance strategies. However, one downside of these systems is their reliance on known attack signatures for detection of malicious network events. When it comes to unknown attack types and zero-day exploits, even modern machine learning based NIDS often fall short. In this paper, we introduce an unconventional approach to identifying network traffic features that influence novelty detection based on survival analysis techniques. Specifically, we combine several Cox proportional hazards models and implement Kaplan-Meier estimates to predict the probability that a classifier identifies novelty after the injection of an unknown network attack at any given time. The proposed model is successful at pinpointing PSH Flag Count, ACK Flag Count, URG Flag Count, and Down/Up Ratio as the main features to impact novelty detection via Random Forest, Bayesian Ridge, and Linear Support Vector Regression classifiers.
Description
Citation
Bradley, T., Alhajjar, E. & Bastian, N. (2023). Novelty Detection in Network Traffic: Using Survival Analysis for Feature Identification. Proceedings of the 2023 IEEE International Conference on Assured Autonomy, pp. 11-18. IEEE.
Publisher
IEEE