Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection

By Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, Asaf Shabtai. Network and Distributed System Security Symposium, 2018

1,004 citations recorded by the source corpus.

Neural networks have become an increasingly popular solution for network intrusion detection systems (NIDS). Their capability of learning complex patterns and behaviors make them a suitable solution for differentiating between normal traffic and network attacks. However, a drawback of neural networks is the amount of resources needed to train them. Many network gateways and routers devices, which could potentially host an NIDS, simply do not have the memory or processing power to train and sometimes even execute such models. More importantly, the existing neural network solutions are trained in a supervised manner. Meaning that an expert must label the network traffic and update the model manually from time to time. In this paper, we present Kitsune: a plug and play NIDS which can learn to detect attacks on the local network, without supervision, and in an efficient online manner. Kitsune's core algorithm (KitNET) uses an ensemble of neural networks called autoencoders to collectively differentiate between normal and abnormal traffic patterns. KitNET is supported by a feature extraction framework which efficiently tracks the patterns of every network channel. Our evaluations show that Kitsune can detect various attacks with a performance comparable to offline anomaly detectors, even on a Raspberry PI. This demonstrates that Kitsune can be a practical and economic NIDS.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Transportation

View Paper: https://www.semanticscholar.org/paper/fa11df1157486731afe86af7d6d9254a82d4dbd6

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

In Transportation

Citations in the corpus

A Review of Intrusion Detection Systems Using Machine and Deep Learning in Internet of Things: Challenges, Solutions and Future Directions (2020, methodology): “The most recent dataset, specifically related to the evaluation of IDS for IoT networks is generated by the authors [41] as part of their research work on online network IDS.”
Deep Learning With Edge Computing: A Review (2019, background): “Using deep learning for network functions, such as for intrusion detection [49], [50] and wireless scheduling [51], has been proposed.”
Federated Learning for Malware Detection in IoT Devices (2021, background): “In [19], the evaluation dataset consists of a network made of 8 security cameras suffering from several attacks.”
A Survey of Deep Learning Methods for Cyber Security (2019, methodology): “[129] created an ensemble of autoencoders, ranging in number from two to 48, that were tasked with reconstructing subsets of features, determined using clustering with correlation as the distance metric.”
SSD: A Unified Framework for Self-Supervised Outlier Detection (2021, methodology): “For example, autoencoder (AE) (Hawkins et al., 2002) based outlier detectors have achieved success in applications such as intrusion detection (Mirsky et al., 2018), and fraud detection (Schreyer et al., 2017).”
A critical review of intrusion detection systems in the internet of things: techniques, deployment strategy, validation strategy, attacks, public datasets and challenges (2021, methodology): “Autoencoders have been used for developing online IoT IDS (Mirsky et al., 2018).”
Adversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive Survey (2023, methodology): “Multiple DL-based NIDS have been proposed based on AEs [39], [47], [54].”
CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment (2023, background): “The authors in [38] introduce the Kitsune (2019) dataset, which is composed of four different categories of attacks executed against nine IoT devices.”
Anomaly Detection in Time Series: A Comprehensive Evaluation (2022, neutral): “6% 250 249 Kitsune [92] real multi 2,335,288 17.”
Learning Graph Structures With Transformer for Multivariate Time-Series Anomaly Detection in IoT (2021, positive): “3) Baselines: We compare our GTA with a wide range of state-of-the-arts in multivariate time series anomaly detection, including: (1) reconstruction-based models: PCA, AE [10], KitNet [57], DAGMM [12], GAN-Li [20], OmniAnomaly [13], LSTM-VAE [11], MAD-GAN [6], and (2) forecasting-9 based models: KNN”
Multivariate Time-series Anomaly Detection via Graph Attention Network (2020, methodology): “From another perspective, existing anomaly detection models can also be categorized into two paradigms, namely forecasting-based models [2], [14], [15] and reconstructionbased models [4], [11]–[13].”