DYNAMO: Towards Network Attack Campaign Attribution via Density-Aware Active Learning - Inria - Institut national de recherche en sciences et technologies du numérique
Communication Dans Un Congrès Année : 2024

DYNAMO: Towards Network Attack Campaign Attribution via Density-Aware Active Learning

Résumé

Network attack attribution is crucial for identifying and understanding attack campaigns, and implementing preemptive measures. Traditional machine learning approaches face challenges such as labor-intensive cam- paign annotation, imbalanced attack data distribution, and concept drift. To address these challenges, we propose DYNAMO, a novel weakly supervised and human-in-the-loop machine learning framework for au- tomated network attack attribution using raw network traffic records. DYNAMO integrates self-supervised learning and density-aware active learning techniques to reduce the overhead of exhaustive annotation, query- ing human analysts to label only a few selected highly representative network traffic samples. Our experiments on the CTU-13 dataset demonstrate that annotating less than 3% of the records achieves attribution accuracy comparable to fully supervised approaches with twice as many labeled records. Moreover, compared to clas- sic active learning and semi-supervised techniques, DYNAMO achieves 20% higher attribution accuracy and nearly perfect detection accuracy for unknown botnet campaigns with minimal annotations.
Fichier principal
Vignette du fichier
127591.pdf (589.82 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04877620 , version 1 (10-01-2025)

Licence

Identifiants

Citer

Helene Orsini, Yufei Han. DYNAMO: Towards Network Attack Campaign Attribution via Density-Aware Active Learning. 21st International Conference on Security and Cryptography, Jul 2024, Dijon, France. pp.91-102, ⟨10.5220/0012759100003767⟩. ⟨hal-04877620⟩
0 Consultations
0 Téléchargements

Altmetric

Partager

More