From Detection to Classification: A Coarse-to-Fine Framework for Network Intrusion Detection

The network intrusion detection system (NIDS) is vital for strengthening computer systems against cyber attacks. Existing network intrusion detection methods focus on distinguishing benign traffic from attacks, ignoring the importance of further discriminating and classifying unknown attacks from detected attacks. To enhance the capability of existing intrusion detection methods to address unknown attacks, we propose a coarse-to-fine framework for network intrusion detection. The first stage aims to distinguish benign traffic from attacks. The second stage further discriminates whether the detected attacks belong to the known or unknown categories. The third stage employs supervised learning for known attack classification and zero-shot learning for unknown attack classification. From one perspective, this framework provides class-level information about detected attacks. From another perspective, it also decouples the network intrusion detection task into multiple fine-grained independent stages. Experimental results on the public benchmark dataset CIC-IDS-2017 demonstrate the effectiveness of the proposed framework.