Ongoing Learning for Intrusion Detection

摘要

By balancing the observation signals used to train the network intrusion detection model, it is possible to more accurately allocate computing resources to protect the network from malicious third parties. The model is trained on live data and historical data defined within a rolling window to detect user-defined features within this data. Automated attacks ensure that different kinds of attacks always exist within the rolling training window. A set of models is always trained to determine which models to produce, alert intrusion analysts, and / or automatically deploy countermeasures. The model is constantly updated as features are redefined and the data in the rolling window changes, and the contents of the rolling window are balanced to provide sufficient data of each observed type to use to train the model. When balancing datasets, low rate signals are overwritten with high rate signals to balance their relative numbers.