A Unified Framework for Hybrid Network Intrusion Detection

Lately, hybrid network intrusion detection systems (HNIDSs) have progressed significantly. Through the cascade or ensemble of multiple machine learning models, HNIDS benefits from each model and achieves better performance. A widely adopted framework for designing HNIDS consists of two models: a misuse detector and an anomaly detector. However, (1) benign traffic must be analyzed by both models, reducing inference speed; (2) the misuse detector performs dual functionalities, leading to suboptimal accuracy; (3) deploying the misuse and anomaly detectors on two devices introduces substantial latency and restricts distributed deployment. In this paper, we propose a unified framework called AUF. To solve (1), we deploy the anomaly detector in the first stage rather than the second, which improves inference speed. To solve (2), we employ two independent models to implement the misuse detector’s functionality, enhancing overall accuracy. To solve (3), we ensure that the different models operate independently, supporting distributed deployment. To demonstrate the effectiveness of the AUF framework, we implement XGBoost for detection and classification and propose an adaptive k-nearest neighborhood-based approach to achieve accurate discrimination. We also introduce zero-shot learning to showcase the framework’s customized model. Extensive experiments validate the effectiveness of the AUF framework and methods. Our code is available at https://github.com/wangyann2000/A-Unified-Framework-for-Hybrid-Network-Intrusion-Detection.