论文标题
Dualnet：找到然后通过深度注意网络检测有效有效载荷
DualNet: Locate Then Detect Effective Payload with Deep Attention Network
论文作者
论文摘要
网络入侵检测（NID）是一种必不可少的防御策略，用于在大规模网络空间中发现可疑用户行为的痕迹，并且由于其自动化和智能的能力，机器学习（ML）近年来已逐渐被用作主流狩猎方法。但是，传统的基于ML的网络入侵检测系统（NIDSS）不能有效地识别未知威胁，并且其高检测率通常伴随着高误报的成本，这导致了警报疲劳的问题。为了解决上述问题，在本文中，我们提出了一个新型的基于神经网络的检测系统Dualnet，该系统是由一般特征提取阶段和关键特征学习阶段构建的。双网络可以根据其对促进整个学习过程的重要性迅速重复使用时空特征，并同时减轻深度学习（DL）中发生的几个优化问题。我们在两个基准网络攻击数据集NSL-KDD和UNSW-NB15上评估了双Net。我们的实验表明，双网的表现优于基于ML的NIDSS，并且在准确性，检测率和错误警报率方面，对于NID的现有DL方法比现有的DL方法更有效。
Network intrusion detection (NID) is an essential defense strategy that is used to discover the trace of suspicious user behaviour in large-scale cyberspace, and machine learning (ML), due to its capability of automation and intelligence, has been gradually adopted as a mainstream hunting method in recent years. However, traditional ML based network intrusion detection systems (NIDSs) are not effective to recognize unknown threats and their high detection rate often comes with the cost of high false alarms, which leads to the problem of alarm fatigue. To address the above problems, in this paper, we propose a novel neural network based detection system, DualNet, which is constructed with a general feature extraction stage and a crucial feature learning stage. DualNet can rapidly reuse the spatial-temporal features in accordance with their importance to facilitate the entire learning process and simultaneously mitigate several optimization problems occurred in deep learning (DL). We evaluate the DualNet on two benchmark cyber attack datasets, NSL-KDD and UNSW-NB15. Our experiment shows that DualNet outperforms classical ML based NIDSs and is more effective than existing DL methods for NID in terms of accuracy, detection rate and false alarm rate.
