This project develops a reconstruction-based anomaly detection system for network intrusions, utilizing autoencoders with attention mechanism to identify intrusions by analyzing the loss in reconstructing network traffic data. This approach works better than classical classifiers, which need to be trained on every possible attack type, and fail to detect novel attacks. Attention mechanism also allows it to capture time dependencies across packets.
Image credit: IEEE
Publication:
@inproceedings{wang_deep_2018,
abstract = {In computer systems, information leaks from the physical hardware through side-channel signals such as power draw. We can exploit these signals to infer the state of ongoing computational tasks without having direct access to the device. This paper investigates the application of recent deep learning techniques to side-channel analysis in both classification of machine state and anomaly detection. We use real data collected from three different devices: an Arduino, a Raspberry Pi, and a Siemens PLC. For classification we compare the performance of a Multi-Layer Perceptron and a Long Short-Term Memory classifiers. Both achieve near-perfect accuracy on binary classification and around 90% accuracy on a multi-class problem. For anomaly detection we explore an autoencoder based model. Our experiments show the potential of using these deep learning techniques in side-channel analysis and cyber-attack detection.},
author = {Wang, Xiao and Zhou, Quan and Harer, Jacob and Brown, Gavin and Qiu, Shangran and Dou, Zhi and Wang, John and Hinton, Alan and Gonzalez, Carlos Aguayo and Chin, Peter},
booktitle = {Cyber Sensing 2018},
doi = {10.1117/12.2311329},
editor = {Ternovskiy, Igor V. and Chin, Peter},
keywords = {Anomaly Detection, Classification, Deep Learning, Side-channel Analysis},
note = {Backup Publisher: International Society for Optics and Photonics},
pages = {37 — 44},
publisher = {SPIE},
title = {Deep learning-based classification and anomaly detection of side-channel signals},
url = {https://doi.org/10.1117/12.2311329},
volume = {10630},
year = {2018}
}