Supervised learning has been widely used for attack categorization, requiring high-quality data and labels. However, the data is often imbalanced and it is difficult to obtain sufficient annotations. Moreover, supervised models are subject to real-world deployment issues, such as defending against unseen artificial attacks. To tackle the challenges, we propose a semi-supervised fine-grained attack categorization framework consisting of an encoder and a two-branch structure and this framework can be generalized to different supervised models. The multilayer perceptron with residual connection is used as the encoder to extract features and reduce the complexity. The Recurrent Prototype Module (RPM) is proposed to train the encoder effectively in a semi-supervised manner. To alleviate the data imbalance problem, we introduce the Weight-Task Consistency (WTC) into the iterative process of RPM by assigning larger weights to classes with fewer samples in the loss function. In addition, to cope with new attacks in real-world deployment, we propose an Active Adaption Resampling (AAR) method, which can better discover the distribution of unseen sample data and adapt the parameters of encoder. Experimental results show that our model outperforms the state-of-the-art semi-supervised attack detection methods with a 3% improvement in classification accuracy and a 90% reduction in training time.
翻译:在攻击分类中,广泛使用监督的学习方法,需要高质量的数据和标签。然而,数据往往不平衡,难以得到充分的说明。此外,受监督的模型受到真实世界部署问题的影响,例如保护不受看不见的人工攻击。为了应对挑战,我们建议采用半监督的精细攻击分类框架,由编码器和两分结构组成,这个框架可以推广到不同的监督模式。除了在实际部署中应付新的攻击外,还使用与剩余连接的多层透视器来提取特征和减少复杂性。经常的原型模块(RPM)建议以半监督的方式有效地培训编码器。为了减轻数据不平衡问题,我们建议将Weight-Task Consistic(WTC)引入RPM的迭接过程,将更大的权重分配给损失功能中样品较少的班级。此外,我们提议采用主动调整系统重的重新校准(AAR)方法来提取特征和降低复杂性。为了更好地发现在远程抽样数据中传播的样本数据,并调整了我们测试模型的精确度的90%的升级方法。