Hybrid Network Intrusion Detection

摘要

We report on a machine learning classifier that can be used to discover the patterns hidden within large networking data flows. It utilizes an existing intrusion detection system (IDS) as an oracle to learn a faster, less resource intensive normalcy classifier as a front-end to a hybrid network IDS. This system has the capability to recognize new attacks that are similar to known attack signatures. It is also more highly scalable and distributable than the signature-based IDS. The new hybrid design also allows distributed updates and retraining of the normalcy classifier to stay up-to-date with current threats.