IN-SITU TRAINABLE INTRUSION DETECTION SYSTEM

摘要

A computer implemented method detects intrusions using a computer by analysing network traffic. The method includes a semi-supervised learning module connected to a network node. The learning module uses labeled and unlabeled data to train a semi-supervised machine learning sensor. The method records events that include a feature set made up of unauthorized intrusions and benign computer requests. The method identifies at least some of the benign computer requests that occur during the recording of the events while treating the remainder of the data as unlabeled. The method trains the semi-supervised learning module at the network node in-situ, such that the semi-supervised learning modules may identify malicious traffic without relying on specific rules, signatures, or anomaly detection.

主权项

1. A computer implemented method that detects intrusions using a computer by analysing network traffic:
coupling a semi-supervised learning module to a network node that uses labeled an unlabeled data to train a semi-supervised machine learning sensor; recording events that comprise a feature set that include unauthorized intrusions and benign requests; identifying at least some of the benign behavior that occurs during the recording of the events while treating the remainder of the data as unlabeled; and training the semi-supervised learning module at the network node in-situ, such that the semi-supervised learning modules may identify malicious traffic without relying on specific rules, signatures, or an anomaly detection.