Skip to main navigation Skip to search Skip to main content

Intrusion Detection based on Non-negative Positive-unlabeled Learning

  • School of Computer Science and Technology (School of Software), Harbin Institute of Technology Weihai
  • China Industrial Control Systems Cyber Emergency Response Team

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

Due to the diversity of network traffic flow, intrusion detection is usually studied as an anomaly detection problem. In this paper, Positive-unlabeled with Non-negative Risk Estimator(nnPU) learning is introduced for intrusion detection. The cyber attacks is treated as positive samples in PU learning. A risk estimator is raised to estimates the binary classification loss. For data imbalance in intrusion detection, we improve the risk estimator of nnPU through focal loss(FL-nnPU). The dynamic weights in focal loss is used to balance the small class prior. The experiments result show that FL-nnPU have a close performance to binary classification, and it performs better than nnPU under data imbalance problems.

Original languageEnglish
Title of host publicationProceedings of 2020 IEEE 9th Data Driven Control and Learning Systems Conference, DDCLS 2020
EditorsMingxuan Sun, Huaguang Zhang
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages1015-1020
Number of pages6
ISBN (Electronic)9781728159225
DOIs
StatePublished - 20 Nov 2020
Externally publishedYes
Event9th IEEE Data Driven Control and Learning Systems Conference, DDCLS 2020 - Liuzhou, China
Duration: 20 Nov 202022 Nov 2020

Publication series

NameProceedings of 2020 IEEE 9th Data Driven Control and Learning Systems Conference, DDCLS 2020

Conference

Conference9th IEEE Data Driven Control and Learning Systems Conference, DDCLS 2020
Country/TerritoryChina
CityLiuzhou
Period20/11/2022/11/20

Keywords

  • data imbalance
  • intrusion detection
  • positive-unlabeled learning
  • risk estimator

Fingerprint

Dive into the research topics of 'Intrusion Detection based on Non-negative Positive-unlabeled Learning'. Together they form a unique fingerprint.

Cite this