Knowledge-Driven Rapid Adaptation to New Attacks

Abstract

Networks are expected to provide ubiquitous services, introducing new and unknown attack threats. Neural Network (NN) based attack detection methods hold promise, but their practical application faces challenges of adaptability, data intensity, and privacy concerns. To overcome these obstacles, we propose a knowledge-driven approach for rapid adaptation to new attacks. First, we establish a privacy-preserving process for sharing and updating Attack Detection Knowledge (ADK), encompassing known attack detection functions and predicted class probability samples. We formulate the problem of rapid adaptation to new attacks driven by this knowledge. Next, we design the Knowledge-Driven Rapid Adaptation (KDRA) method by combining ensemble learning and meta-learning. The Base Model Selection with the Probability Difference Ranking (BMSPDR) algorithm is proposed to simplify the ensemble. Base models and predicted class probability components are extracted to generate learning tasks. To enhance detection performance, we introduce fine-tuning for the meta-model of the prototypical network on the target learning task. Finally, we construct an ADK base using public and self-generated datasets. Experimental results demonstrate that KDRA outperforms baselines in detecting new attacks not in the knowledge base and with varying detection difficulty. Comparative analysis reveals that KDRA significantly enhances detection performance and reduces adaptation time through ADK driving.