Network Anomaly Detection Using Federated Learning and Transfer Learning
Since deep neural networks can learn data representation from training data automatically, deep learning methods are widely used in the network anomaly detection. However, challenges of deep learning-based anomaly detection methods still exist, the major
- PDF / 891,831 Bytes
- 13 Pages / 439.37 x 666.142 pts Page_size
- 40 Downloads / 543 Views
2
College of Information Science and Technology, Beijing University of Chemical Technology, Beijing 100029, China {zhaoy,chenjj}@mail.buct.edu.cn Library, Beijing University of Chemical Technology, Beijing 100029, China [email protected] 3 Center for Information, Beijing University of Chemical Technology, Beijing 100029, China [email protected] 4 School of Computer Science, University of Technology Sydney, Sydney, NSW 2194, Australia [email protected]
Abstract. Since deep neural networks can learn data representation from training data automatically, deep learning methods are widely used in the network anomaly detection. However, challenges of deep learningbased anomaly detection methods still exist, the major of which is the training data scarcity problem. In this paper, we propose a novel network anomaly detection method (NAFT) using federated learning and transfer learning to overcome the data scarcity problem. In the first learning stage, a people or organization Ot , who intends to conduct a detection model for a specific attack, can join in the federated learning with a similar training task to learn basic knowledge from other participants’ training data. In the second learning stage, Ot uses the transfer learning method to reconstruct and re-train the model to further improve the detection performance on the specific task. Experiments conducted on the UNSW-NB15 dataset show that the proposed method can achieve a better anomaly detection performance than other baseline methods when training data is scarce. Keywords: Network traffic analysis learning
1
· Federated learning · Transfer
Introduction
With the development of information technology, communication networks play a critical role in all facets of society and gradually changes the way people live. For example, paperless offices through computer networks can facilitate information sharing and save resources, and video communication can be done with network applications rather than telephone. Moreover, many novel technologies, such c Springer Nature Singapore Pte Ltd. 2020 S. Yu et al. (Eds.): SPDE 2020, CCIS 1268, pp. 219–231, 2020. https://doi.org/10.1007/978-981-15-9129-7_16
220
Y. Zhao et al.
as the Internet of Things (IoT) and the Internet of Vehicles (IoV), are also based on communication networks. While bringing great convenience to people, computer networks are facing enormous security challenges. Cyber attacks are threatening the financial interests of business organizations and the privacy of individuals, such as ransomware [1], cryptojacking [2], DDoS attacks [3], and others. Therefore, it is necessary to ensure cybersecurity to retain the computer network’s integrity and availability. Researchers have proposed various methods to identify cyber attacks during the last ten years [4–6]. Network anomaly detection systems are widely used in the cyber security field. Network anomaly detection systems can be generally categorized into two groups, misused-based method and anomaly-based method [7]. The misused-based method focuses
Data Loading...
