Active Learning for Network Intrusion Detection

Network operators are generally aware of common attack vectors that they defend against. For most networks, the vast majority traffic is legitimate. However, new continually designed and attempted by bad actors which bypass detection go unnoticed due to low volume. One strategy for finding such activity look anomalous behavior. Investigating behavior requires significant time resources. Collecting a large number labeled examples training supervised models both prohibitively expensive subject obsoletion as attacks surface. A purely unsupervised methodology ideal; however, research has shown even very small can significantly improve quality anomaly detection. minimizes required labels while maximizing desirable. False positives in this context result wasted effort or blockage legitimate traffic, false negatives translate undetected attacks. We propose general active learning framework experiment with different choices learners sampling strategies.