目前基于机器学习的入侵检测系统大都建立在入侵数据始终保持统计平稳的假设之上,无法应对攻击者有意改变数据特性或新型攻击方式的出现,而导致的检测率下降的状况。对于上述问题,即攻击漂移,提出了加权R6nyi距离的检测方法。在KDDCup99数据集上的实验证明,R6nyi距离可以有效地增强检测效果;在检测到漂移后,通过重新训练模型可以使得对攻击的识别率显著提高。
The recent intrusion detection systems based on machine learning generally assume that the intrusion traffic always satisfies stationary of statistics. However, this assumption is not always held when adversaries arbitrarily alter the distribution of traffic data, or develop new attack techniques, which may reduce the detection rate. To overcome this adversarial drift, a novel drift detection approach based on weighted Renyi distance was suggested. The experiment on KDD Cup99 shows that the weighted R6nyi distance is able to perfectly detect the adversarial drift, and improve the intrusion detection rate by retraining the model.