Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

LLM-based Continuous Intrusion Detection Framework for Next-Gen Networks

Frederic Adjewa, Moez Esseghir, Leila Merghem-Boulahia

TL;DR

An adaptive framework designed for the continuous detection, identification and classification of emerging attacks in network traffic that employs a transformer encoder architecture that captures hidden patterns in a bidirectional manner to differentiate between malicious and legitimate traffic is presented.

Abstract

In this paper, we present an adaptive framework designed for the continuous detection, identification and classification of emerging attacks in network traffic. The framework employs a transformer encoder architecture, which captures hidden patterns in a bidirectional manner to differentiate between malicious and legitimate traffic. Initially, the framework focuses on the accurate detection of malicious activities, achieving a perfect recall of 100\% in distinguishing between attack and benign traffic. Subsequently, the system incrementally identifies unknown attack types by leveraging a Gaussian Mixture Model (GMM) to cluster features derived from high-dimensional BERT embeddings. This approach allows the framework to dynamically adjust its identification capabilities as new attack clusters are discovered, maintaining high detection accuracy. Even after integrating additional unknown attack clusters, the framework continues to perform at a high level, achieving 95.6\% in both classification accuracy and recall.The results demonstrate the effectiveness of the proposed framework in adapting to evolving threats while maintaining high accuracy in both detection and identification tasks. Our ultimate goal is to develop a scalable, real-time intrusion detection system that can continuously evolve with the ever-changing network threat landscape.

LLM-based Continuous Intrusion Detection Framework for Next-Gen Networks

TL;DR

An adaptive framework designed for the continuous detection, identification and classification of emerging attacks in network traffic that employs a transformer encoder architecture that captures hidden patterns in a bidirectional manner to differentiate between malicious and legitimate traffic is presented.

Abstract

In this paper, we present an adaptive framework designed for the continuous detection, identification and classification of emerging attacks in network traffic. The framework employs a transformer encoder architecture, which captures hidden patterns in a bidirectional manner to differentiate between malicious and legitimate traffic. Initially, the framework focuses on the accurate detection of malicious activities, achieving a perfect recall of 100\% in distinguishing between attack and benign traffic. Subsequently, the system incrementally identifies unknown attack types by leveraging a Gaussian Mixture Model (GMM) to cluster features derived from high-dimensional BERT embeddings. This approach allows the framework to dynamically adjust its identification capabilities as new attack clusters are discovered, maintaining high detection accuracy. Even after integrating additional unknown attack clusters, the framework continues to perform at a high level, achieving 95.6\% in both classification accuracy and recall.The results demonstrate the effectiveness of the proposed framework in adapting to evolving threats while maintaining high accuracy in both detection and identification tasks. Our ultimate goal is to develop a scalable, real-time intrusion detection system that can continuously evolve with the ever-changing network threat landscape.

Paper Structure

This paper contains 11 sections, 7 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Proposed framework
  4. methodology
  5. Datasets and preprocessing
  6. Model design
  7. EXPERIMENTATIONS AND DISCUSSION
  8. Evaluation metrics
  9. Simulation setup
  10. Results and discussion
  11. CONCLUSION

Figures (7)

  • Figure 1: LLM-based Continuous Intrusion Detection Framework Architecture
  • Figure 2: Model architecture with light BERT as backbone
  • Figure 3: Performance of the Binary Detector
  • Figure 4: Initial performance of the contious learning model
  • Figure 5: Evaluation of clustering results for Chunk 1: silhouette score, t-SNE visualization, and confusion matrix
  • ...and 2 more figures