Lifelong learning based intelligent, diverse, agile, and robust system for network attack detection
A lifelong learning intrusion detection system and methods are provided. The system may capture network data directed to a host node. The host node may include a honeypot. The honeypot may emulate operation of a physical or virtual device to attract malicious activity. The system may classify, based on a supervised machine learning model, the network data as being not malicious or not malicious. The system may classify, based on an unsupervised machine learning model, the network data as being anomalous or not anomalous. The system may alter operation of the honeypot to induce malicious activity. The system may determine, after operation of the honeypot is altered, the honeypot is accessed. The system may retrain the supervised machine learning model and/or unsupervised machine learning model based the network data.
1. A system comprising:
a processor, the processor configured to:
capture network data directed to a host node, the host node comprising a honeypot, the honeypot configured to emulate operation of a physical or virtual device to attract malicious activity;
classify, based on a supervised machine learning model, the network data as being one of malicious or not malicious;
classify, based on an unsupervised machine learning model, the network data as being one of anomalous or not anomalous;
alter operation of the honeypot in response to classifying the network data as not malicious based on the supervised machine learning model and in response to classifying the network data as anomalous based on the unsupervised machine learning model;
determine, after operation of the honeypot is altered, the honeypot is accessed; and
retrain, in response to altering operation of the honeypot and determining the honeypot is accessed, the supervised machine learning model and unsupervised machine learning model based on the network data.
2. The system of claim 1 , wherein to alter operation of the honeypot the processor is further configured to:
select a predetermined instruction configured to cause the honeypot to alter operation; and
execute the predetermined instruction.
3. The system of claim 1 , wherein the supervised machine learning model is trained based on a plurality of attack signatures stored in a repository.
4. The system of claim 3 , wherein to retrain the supervised machine learning model, the processor is further configured to:
determine features based on the network data;
generate a new attack signature comprising the determined features; and
store the new attack signature in the repository.
5. The system of claim 1 , wherein the processor is further configured to:
extract, from the network data, features from a physical layer portion of the network data and the network layer portion of the network data.
6. The system of claim 1 , wherein the unsupervised machine learning model comprises a one-class deep neural network.
7. The system of claim 1 , wherein to alter operation of the honeypot, the processor is further configured to:
identify a plurality of commands associated with respective reward metrics, the respective reward metrics inversely proportional to a measure of confidence to forecast a response from a source node after execution of the plurality of commands, respectively;
determine a reward metric associated with the command satisfies a predetermined selection criterion; and
select a command from the plurality of commands in response to satisfaction of the predetermined selection criterion.
8. The system of claim 7 , wherein satisfaction of the predetermined selection criteria comprises the reward metric being greater than a threshold reward value or the reward metric being ranked highest among the respective reward metrics.
9. A method, comprising
capturing network data directed to a host node, the host node comprising a honeypot, the honeypot configured to emulate operation of a physical or virtual device to attract malicious activity;
classifying, based on a supervised machine learning model, the network data as being malicious or not malicious; and
classifying, based on an unsupervised machine learning model, the network data as being anomalous or not anomalous;
after classifying the network data with both the supervised and unsupervised machine learning model:
altering operation of the honeypot in response to the network data being classified as anomalous and not malicious;
determining, after operation of the honeypot is altered, the honeypot is accessed; and
retraining, in response to the honeypot being accessed, at least one of the supervised machine learning model and unsupervised machine learning model with features from the network data.
10. The method of claim 9 , wherein altering operation of the honeypot the further comprises:
selecting a predetermined instruction configured to cause honeypot to alter operation; and
executing the predetermined command.
11. The method of claim 9 , wherein the supervised machine learning model is trained based on a plurality of attack signatures stored in a repository.
12. The method of claim 9 , retraining the supervised machine learning model comprises:
determining features based on the network data; generating a new attack signature comprising the determined features; and storing the new attack signature in the repository.
13. The method of claim 9 , further comprising:
extracting, from the network data, features from a physical layer portion of the network data and the network layer portion of the network data.
14. The method of claim 9 , wherein the unsupervised machine learning model comprises a one-class deep neural network.
15. The method of claim 9 , wherein to alter operation of the honeypot, the processor is further configured to:
identifying a plurality of commands associated with respective reward metrics, the respective reward metrics inversely proportional to a measure of confidence of receiving a subsequent response from a remote user after the honeypot is altered;
determining a reward metric associated with the command satisfies a predetermined selection criterion; and
selecting a command from the plurality of commands in response to satisfaction of the predetermined selection criterion.
16. The method of claim 15 , wherein satisfaction of the predetermined selection criteria comprises the reward metric being greater than a threshold reward value or the reward metric being ranked highest among the respective reward metrics.
17. A non-transitory computer readable storage medium comprising:
a plurality of instructions executable by a processor, the instructions comprising:
instructions executable by the processor to capture network data directed to a host node, the host node comprising a honeypot, the honeypot configured to emulate operation of a physical or virtual device to attract malicious activity; and
instructions executable by the processor to classify, based on a supervised machine learning model, the network data as being malicious or not malicious;
instructions executable by the processor to classify, based on an unsupervised machine learning model, the network data as being anomalous or not anomalous;
instructions executable by the processor to enhance the supervised machine learning model and unsupervised machine learning model, the instructions comprising:
instructions executable by the processor to alter operation of the honeypot after the network data is classified as anomalous and not malicious;
instructions executable by the processor to determine, after operation of the honeypot is altered, the honeypot is accessed; and
instructions executable by the processor to retrain the supervised machine learning model and the unsupervised machine learning model with features from the network data in response to the honeypot being accessed.
18. The non-transitory computer readable storage medium of claim 17 , wherein the instructions to alter operation of the honeypot further comprise:
instructions executable by the processor to identify a plurality of commands associated with respective reward metrics, the respective reward metrics inversely proportional to a measure of confidence of receiving a subsequent response from a remote user after the honeypot is altered;
instructions executable by the processor to determine a reward metric associated with the command satisfies a predetermined selection criterion; and
selecting a command from the plurality of commands in response to satisfaction of the predetermined selection criterion.
19. The non-transitory computer readable storage medium of claim 18 , wherein satisfaction of the predetermined selection criteria comprises the reward metric being greater than a threshold reward value or the reward metric being ranked highest among the respective reward metrics.
20. The non-transitory computer readable storage medium of claim 17 , the instructions executable by the processor to retrain the supervised machine learning model further comprise:
instructions executable by the processor to determine features based on the network data;
instructions executable by the processor to generate a new attack signature comprising the determined features; and
instructions executable by the processor to store the new attack signature in the repository.