Unsupervised GAN-based intrusion detection system using temporal convolutional networks, self-attention, and transformers
There is provided a method for detecting cyber-attacks at edge servers. The method comprises receiving network traffic. The method comprises extracting and normalizing network flow features from the network traffic to produce a data pattern for evaluation. The method comprises computing an anomaly detection score for the data pattern for evaluation. The method comprises comparing the anomaly detection score with a threshold and determining if the network traffic corresponds to normal traffic or to an anomaly. The method comprises, upon determining that the network traffic corresponds to an anomaly, mitigating malicious network traffic by triggering a mitigation strategy and sending an anomaly message to an anomaly classifier. A method for classifying cyber-attacks at a cloud server is also provided.
1 . A method for detecting cyber-attacks at edge servers, comprising:
receiving network traffic;
extracting and normalizing network flow features from the network traffic to produce a data pattern for evaluation;
computing an anomaly detection score for the data pattern for evaluation;
comparing the anomaly detection score with a threshold and determining if the network traffic corresponds to normal traffic or to an anomaly;
upon determining that the network traffic corresponds to an anomaly, mitigating malicious network traffic by triggering a mitigation strategy and sending an anomaly message to an anomaly classifier;
retraining the anomaly detector, using federated learning, when triggered by a cloud server running the anomaly classifier upon obtention of new datasets of network traffic;
receiving a new training dataset with normal traffic data from the cloud server;
retraining a generative adversarial network (GAN) generator neural network and a GAN discriminator neural network of the anomaly detector;
periodically sending weights of the neural networks of the generator and discriminator to the cloud server;
receiving average generator weights and average discriminator weights from the cloud server;
updating the weights of the neural networks of the generator and discriminator using the average generator weights and average discriminator weights received from the cloud server, and resuming training; and
replacing the current GAN generator neural network and the GAN discriminator neural network with the retrained GAN generator neural network and GAN discriminator neural network.
2 . The method of claim 1 , wherein the generator learns a probabilistic distribution of a training set, enabling production, by the generator, of data similar to the training set and wherein the discriminator learns how to distinguish between real data and data produced by the generator.
3 . The method of claim 2 , wherein the training set comprises only data corresponding to normal traffic, thereby enabling the discriminator to distinguish between the learned normal traffic and anomalies without requiring labeled data corresponding to anomalies.
4 . The method of claim 1 , wherein the GAN comprises at least one of each of a temporal convolutional network (TCN) block, a self-attention block, and a transformer block.
5 . The method of claim 1 , wherein the extracting and normalizing network flow features from the network traffic, comprises extracting and normalizing flow duration, total number of packets, number of flow packets per second, and number of flow bytes per second.
6 . The method of claim 1 , wherein the mitigation strategy is selected among any one or more of temporarily dropping packets, resetting connections, deviating traffic, and notifying network hosts.
7 . The method of claim 1 , wherein the anomaly message comprises a geographical location, a timestamp, normalized network flow features, and a computed anomaly detection score value.
8 . The method of claim 1 , wherein the threshold is defined during the training of the GAN and is updated when the GAN is updated.
9 . An edge server running an anomaly detector for detecting cyber-attacks comprising processing circuits and a memory, the memory containing instructions executable by the processing circuits whereby the edge server running the anomaly detector is operative to:
receive network traffic;
extract and normalize network flow features from the network traffic to produce a data pattern for evaluation;
compute an anomaly detection score for the data pattern for evaluation;
compare the anomaly detection score with a threshold and determine if the network traffic corresponds to normal traffic or to an anomaly;
determine that the network traffic corresponds to an anomaly and mitigate malicious network traffic by triggering mitigation strategies and send an anomaly message to an anomaly classifier;
retrain the anomaly detector, using federated learning, when triggered by a cloud server running the anomaly classifier upon obtention of new datasets of network traffic;
receive a new training dataset with normal traffic data from the cloud server;
start retraining a GAN generator neural network and a GAN discriminator neural network of the anomaly detector;
periodically send weights of the neural networks of the generator and discriminator to the cloud server;
receive average generator weights and average discriminator weights from the cloud server;
update the weights of the neural networks of the generator and discriminator using the average generator weights and average discriminator weights received from the cloud server, and resume training; and
replace the current GAN generator neural network and the GAN discriminator neural network with the retrained GAN generator neural network and GAN discriminator neural network.
10 . The edge server of claim 9 , wherein the edge server is further operative to:
receive a validation dataset from the cloud server; and
detect anomalies in the received validation dataset and send back a report with an anomaly detection score computed for each of a plurality of data sample of the validation dataset.