Abstract:

The recent intrusion detection systems based on machine learning generally assume that the intrusion traffic always satisfies stationary of statistics.However,this assumption is not always held when adversaries arbitrarily alter the distribution of traffic data,or develop new attack techniques,which may reduce the detection rate.To overcome this adversarial drift,a novel drift detection approach based on weighted Rényi distance was suggested.The experiment on KDD Cup99 shows that the weighted Rényi distance is able to perfectly detect the adversarial drift,and improve the intrusion detection rate by retraining the model.

Key words: intrusion detection, attack traffic, adversarial drift, weighted Rényi distance