ASAP: Automatic Synthesis of Attack Prototypes, an online-learning, end-to-end approach

• Published in: Computer networks (Amsterdam, Netherlands : 1999) Netherlands : 1999), 2024-12, Vol.254, p.110828, Article 110828
• Main Authors: Cevallos M., Jesús F., Rizzardi, Alessandra, Sicari, Sabrina, Coen-Porisini, Alberto
• Format: Article
• Language: English
• Subjects: Collective anomaly detection; Internet of Things; Out-of-distribution generalization; Zero-day attack detection
• ISSN: 1389-1286
• DOI: 10.1016/j.comnet.2024.110828

Zero-day attack detection and categorization is an open-research field where four main context factors need to be taken into account: novel or zero-day attacks (i) are unlabeled by definition, (ii) may correspond to out-of-distribution data, (iii) can arise concurrently, and (iv) distribution shifts in the feature space need online-learning. Given such constraints, the online detection and categorization of new cyber threats can be modeled as a heterogeneous collective anomaly detection problem, for which no online-learning solutions exist purely based on back-propagation. To this respect, this paper presents an online-learning, end-to-end back-propagation strategy for Automatically Synthesizing the potential signatures or Attack Prototypes of novel cyber threats (asap). The presented framework incorporates automatic feature engineering, operating over raw data from the OpenFlow monitoring API and raw bytes of traffic captures. In asap, specialized inductive biases enhance the training data efficiency and accommodate the inference machinery to resource-constrained scenarios such as the Internet of Things. Finally, the validity of this framework is demonstrated in a live training experiment comprising IoT traffic emulation 33To foster research in the field, the source-code of asap alongside instructions to reproduce the experiments are made publicly available among the set of SmartVille NID models in [1]..