Zero-shot learning for intrusion detection via attribute representation

Abstract

Network intrusion detection is an important network security infrastructure. Although numerous studies based on machine learning have explored how to enable intrusion detection to detect unknown novel attack types, so called anomaly detection, little work focuses on using attribute learning methods. An important application of attribute learning is zero-shot learning, which can be used to solve the anomaly detection problem. In this paper, we propose an attribute learning method. A pipeline framework using random forest feature selection and DBSCAN clustering attribute conversion is introduced to convert raw network data into attributes. A comprehensive empirical evaluation demonstrates that our proposed framework sustains the data information effectively and outperforms the state-of-the-art approaches. An extra zero-shot learning experiment show that our attribute approach works well in zero-shot learning scenario.