Improving the Detection of Unknown DDoS Attacks through Continual Learning

Artificial Intelligence (AI)-based Intrusion Detection Systems (IDS) are popular with network security researchers due to their good detection capability and low false alarm rate especially concerning Distributed Denial of Service (DDoS) attacks. However, as the attack pattern usually changes over time, the performance of an IDS that was trained with original data degrades. Moreover, as the changing attack pattern and the emergence of unknown DDoS attacks create more unknown or unlabeled data, a supervised learning approach is not suitable. To mitigate this effect, we propose a robust continual learning method which consists of a semi-supervised approach for pseudo-labeling the unknown data and a sliding window-based retraining scheme. The proposed method is evaluated by using the custom CIC-IDS 2017 dataset, which contains both slow DDoS and flooding DDoS attacks. Three classifiers are considered, namely K-Nearest Neighbors (KNN), XGBoost, and Multilayer Perceptron (MLP). Our evaluation shows that our method is able to improve the detection performance which verifies the quality of the generated pseudo labels.