3D-IDS: Doubly Disentangled Dynamic Intrusion Detection

TL;DR

Network intrusion detection often struggles with inconsistent performance due to entangled feature distributions. 3D-IDS tackles this by employing a doubly disentangled framework: a statistical disentanglement step using a non-parametric SMT optimization to produce edge features h = $\mathbf{w} \odot \mathcal{F}$ that reduce feature entanglement, followed by a representational disentanglement that enforces orthogonality in node embeddings via $\mathcal{L}_{\text{Dis}} = \tfrac{1}{2}\| \mathbf{X}(t)\mathbf{X}(t^{-})^{\top} - \mathbf{I} \|_{F}^{2}$. It then fuses topology through a multi-layer graph diffusion based on a nonlinear, PM-inspired diffusion model, formulated as $\partial\mathbf{X}_{t} = - \mathbf{M}^{\top} \sigma(\mathbf{M} \mathbf{X} \mathbf{K}^{\top}) \mathbf{S}(\mathbf{M} \mathbf{X} \mathbf{K}^{\top}) \mathbf{K}$ and solved via Runge-Kutta. Extensive experiments on five IoT/network benchmarks show state-of-the-art results for both binary and multi-class intrusion tasks and robust detection of unknown attacks, with improved explainability from the disentanglement. The approach promises practical benefits for real-time, family-wide deployment in evolving network environments where both known and unknown threats must be rapidly identified and interpreted.

Abstract

Network-based intrusion detection system (NIDS) monitors network traffic for malicious activities, forming the frontline defense against increasing attacks over information infrastructures. Although promising, our quantitative analysis shows that existing methods perform inconsistently in declaring various unknown attacks (e.g., 9% and 35% F1 respectively for two distinct unknown threats for an SVM-based method) or detecting diverse known attacks (e.g., 31% F1 for the Backdoor and 93% F1 for DDoS by a GCN-based state-of-the-art method), and reveals that the underlying cause is entangled distributions of flow features. This motivates us to propose 3D-IDS, a novel method that aims to tackle the above issues through two-step feature disentanglements and a dynamic graph diffusion scheme. Specifically, we first disentangle traffic features by a non-parameterized optimization based on mutual information, automatically differentiating tens and hundreds of complex features of various attacks. Such differentiated features will be fed into a memory model to generate representations, which are further disentangled to highlight the attack-specific features. Finally, we use a novel graph diffusion method that dynamically fuses the network topology for spatial-temporal aggregation in evolving data streams. By doing so, we can effectively identify various attacks in encrypted traffics, including unknown threats and known ones that are not easily detected. Experiments show the superiority of our 3D-IDS. We also demonstrate that our two-step feature disentanglements benefit the explainability of NIDS.

Figures (8)

• Figure 1: Illustration of two network attacks DoS and MITM. DoS floods the target with massive traffic to overwhelm an online service, and MITM eavesdrops on the communication between two targets and steals private information. An NIDS can be easily deployed in a single location to collect statistical features and alert the administrator for potential threats.
• Figure 2: Quantitative analysis on CTC-TON-IOT. (a) Comparisons of detecting various attacks, which are regarded as an unknown type in evaluation. Specifically, we train an SVM model without using the data points of these attacks, and evaluate the instances of these attacks on the test set. (b) and (c) show the feature distributions of two attacks, MITM and DDoS, respectively. (d) Comparisons of detecting various known attacks on the previous state-of-the-art deep learning model E-GraphSAGE, (e) and (f) are correlation maps of representations of the two attacks, where the representations are generated by E-GraphSAGE.
• Figure 3: Overview of the proposed 3D-IDS, which consists of five modules. 1) Edge construction module builds edges based on traffic flow. 2) Statistical disentanglement module differentiates values in vectors to facilitate the identification of various attacks. 3) Representational disentanglement module learns to highlight attack-specific features. 4) Multi-Layer graph diffusion module fuses the network topology for better aggregation over evolving dynamic traffic. 5) Traffic classifier takes the traffic representation as an input to yield the detection results.
• Figure 4: Comparisons of multi-classification. Here $\dagger$ indicates that the results are directly copied from the previous works.
• Figure 5: Statistical disentanglement of traffic features.