A training-resistant anomaly detection system. Issue 76 (July 2018)

• Record Type: Journal Article
• Authors: Muller, Steve; Lancrenon, Jean; Harpes, Carlo; Le Traon, Yves; Gombault, Sylvain; Bonnin, Jean-Marie
• Is Part Of: Computers & security. Issue 76(2018)
• Page Start: 1
• Page End: 11
• Publication Date: 2018-07
• Subjects: Training attack -- Intrusion detection system -- Anomaly detection -- Network security -- Machine learning; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2018.02.015
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Modern network intrusion detection systems rely on machine learning techniques to detect traffic anomalies and thus intruders. However, the ability to learn the network behaviour in real-time comes at a cost: malicious software can interfere with the learning process, and teach the intrusion detection system to accept dangerous traffic. This paper presents an intrusion detection system (IDS) that is able to detect common network attacks including but not limited to, denial-of-service, bot nets, intrusions, and network scans. With the help of the proposed example IDS, we show to what extent the training attack (and more sophisticated variants of it) has an impact on machine learning based detection schemes, and how it can be detected.