Knowledge-Based Zero-Touch Security under Host and Network Flow Features Merger

Incorporating machine learning algorithms with Intrusion Detection System (IDS) can detect network intrusions without human intervention and aims for Zero Touch Networks (ZTN). In this research, an automatic network-based features and host-based features integrated intrusion detection scheme is presented to improve the performance of network attack detection under the SCVIC-CIDS-2021 dataset which is derived from the integration of network packets and host logs of the CSE-CIC-IDS2018 dataset. Auto-encoder (AE) and Gated Recurrent Unit (GRU) are utilized for feature derivation to overcome the dimensionality mismatch between network-based and host-based features. The knowledge-based Prior Knowledge Input (PKI) model is used to combine unsupervised extra knowledge with a pre-trained supervised model for the final classification results. The results of the experiment reveal that the integration of network-based and host-based features is effective and the PKI model improves the performance of the original ML classification algorithm as well. Under the test set, the maximum achievable macro average F1-score reaches up to 97.08% which points out approximately 9% improvement compared to the best baseline performance.