Inductive and transductive transfer learning for zero-day attack detection

Abstract

Upon application of supervised machine learning techniques Intrusion Detection Systems (IDSs) are successful in detecting known attacks as they use predefined attack signatures. However, detecting zero-day attacks is challenged because of the scarcity of the labeled instances for zero-day attacks. Advanced research on IDS applies the concept of Transfer Learning (TL) to compensate the scarcity of labeled instances of zero-day attacks by making use of abundant labeled instances present in related domain(s). This paper explores the potential of Inductive and Transductive transfer learning for detecting zero-day attacks experimentally, where inductive TL deals with the presence of minimal labeled instances in the target domain and transductive TL deals with the complete absence of labeled instances in the target domain. The concept of domain adaptation with manifold alignment (DAMA) is applied in inductive TL where the variant of DAMA is proposed to handle transductive TL due to non-availability of labeled instances. NSL_KDD dataset is used for experimentation.