Kitsune: An Ensemble of Autoencoders for Online
Network Intrusion Detection
Yisroel Mirsky, Tomer Doitshman, Yuval Elovici and Asaf Shabtai
Ben-Gurion University of the Negev
{yisroel, tomerdoi}@post.bgu.ac.il, {elovici, shabtaia}@bgu.ac.il
Abstract—Neural networks have become an increasingly popu-
lar solution for network intrusion detection systems (NIDS). Their
capability of learning complex patterns and behaviors make them
a suitable solution for differentiating between normal traffic and
network attacks. However, a drawback of neural networks is
the amount of resources needed to train them. Many network
gateways and routers devices, which could potentially host an
NIDS, simply do not have the memory or processing power to
train and sometimes even execute such models. More importantly,
the existing neural network solutions are trained in a supervised
manner. Meaning that an expert must label the network traffic
and update the model manually from time to time.
In this paper, we present Kitsune: a plug and play NIDS
which can learn to detect attacks on the local network, without
supervision, and in an efficient online manner. Kitsune’s core
algorithm (KitNET) uses an ensemble of neural networks called
autoencoders to collectively differentiate between normal and
abnormal traffic patterns. KitNET is supported by a feature
extraction framework which efficiently tracks the patterns of
every network channel. Our evaluations show that Kitsune can
detect various attacks with a performance comparable to offline
anomaly detectors, even on a Raspberry PI. This demonstrates
that Kitsune can be a practical and economic NIDS.
Keywords—Anomaly detection, network intrusion detection, on-
line algorithms, autoencoders, ensemble learning.
I. INTRODUCTION
The number of attacks on computer networks has been
increasing over the years [1]. A common security system used
to secure networks is a network intrusion detection system
(NIDS). An NIDS is a device or software which monitors all
traffic passing a strategic point for malicious activities. When
such an activity is detected, an alert is generated, and sent to
the administrator. Conventionally an NIDS is deployed at a
single point, for example, at the Internet gateway. This point
deployment strategy can detect malicious traffic entering and
leaving the network, but not malicious traffic traversing the
network itself. To resolve this issue, a distributed deployment
strategy can be used, where a number of NIDSs are be
connected to a set of strategic routers and gateways within
the network.
Over the last decade many machine learning techniques
have been proposed to improve detection performance [2], [3],
[4]. One popular approach is to use an artificial neural network
(ANN) to perform the network traffic inspection. The benefit
of using an ANN is that ANNs are good at learning complex
non-linear concepts in the input data. This gives ANNs a
great advantage in detection performance with respect to other
machine learning algorithms [5], [2].
The prevalent approach to using an ANN as an NIDS is
to train it to classify network traffic as being either normal
or some class of attack [6], [7], [8]. The following shows the
typical approach to using an ANN-based classifier in a point
deployment strategy:
1) Have an expert collect a dataset containing both normal
traffic and network attacks.
2) Train the ANN to classify the difference between normal
and attack traffic, using a strong CPU or GPU.
3) Transfer a copy of the trained model to the net-
work/organization’s NIDS.
4) Have the NIDS execute the trained model on the observed
network traffic.
In general, a distributed deployment strategy is only prac-
tical if the number of NIDSs can economically scale according
to the size of the network. One approach to achieve this goal
is to embed the NIDSs directly into inexpensive routers (i.e.,
with simple hardware). We argue that it is impractical to use
ANN-based classifiers with this approach for several reasons:
Offline Processing. In order to train a supervised model, all
labeled instances must be available locally. This is infeasible
on a simple network gateway since a single hour of traffic may
contain millions of packets. Some works propose offloading
the data to a remote server for model training [9] [3]. However,
this solution may incur significant network overhead, and does
not scale.
Supervised Learning. The labeling process takes time and is
expensive. More importantly, what is considered to be normal
depends on the local traffic observed by the NIDS. Further-
more, in attacks change overtime and while new ones are
constantly being discovered [10], so continuous maintainable
of a malicious attack traffic repository may be impractical.
Finally, classification is a closed-world approach to identifying
concepts. In other words, a classifier is trained to identify the
classes provided in the training set. However, it is unreasonable
to assume that all possible classes of malicious traffic can be
collected and placed in the training data.
High Complexity. The computational complexity of an ANN
Permission to freely reproduce all or part of this paper for noncommercial
purposes is granted provided that copies bear this notice and the full citation
on the first page. Reproduction for commercial purposes is strictly prohibited
without the prior written consent of the Internet Society, the first-named author
(for reproduction of an entire paper only), and the author’s employer if the
paper was prepared within the scope of employment.
NDSS ’18, 18-21 February 2018, San Diego, CA, USA
Copyright 2018 Internet Society, ISBN 1-1891562-49-5
http://dx.doi.org/10.14722/ndss.2018.23204
arXiv:1802.09089v2 [cs.CR] 27 May 2018
剩余14页未读，继续阅读
黄浦江畔的夏先生
- 粉丝: 18
- 资源: 299
最新资源
- ACM编程比赛的经验与心得分享-全面提升个人与团队实力
- 点云开发入门教程-带你从点云的基础知识、数据获取、处理到应用开发，逐步深入了解点云开发的世界
- Python 实现高斯光束的基本仿真（含完整的程序和代码详解）
- C++利用MFC（Microsoft Foundation Classes）和OpenCV实现遥感图像的配准和融合（含完整的程序
- MATLAB实现基于RD、CS和RM算法的雷达成像技术（含完整的程序和代码详解）
- MATLAB利用遗传算法、模拟退火和禁忌搜索算法解决车辆路径问题（VRP）（含完整的程序和代码详解）
- python的上下文管理器
- 山竹社区3.4.9【各大手机都可安全安装.apk
- 一个关于TC275 Bootloader的详细设计实例（含完整的程序和代码详解）
- Python 构建并实现一种基于环形拓扑的多目标粒子群优化（mOPSO）算法（含完整的程序和代码详解）
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
评论0