Plusmine: Dynamic Active Learning with Semi-Supervised Learning for Automatic Classification

Abstract

A major problem in cybersecurity research is the correct labeling of up-to-date datasets. It relies on the availability of human experts, and is as such very cumbersome. Motivated by this, two techniques have been proposed for efficient labeling: Active Learning (AL) and Semi-Supervised Learning (SeSL). In this paper, we introduce Plusmine: an intrusion detection method that combines the benefits of AL and SeSL to efficiently automate classification. We develop new techniques for both components. Moreover, we empirically show that Plusmine obtains good and more robust results than benchmark methods.