论文标题
FastPacket：朝着基于FastText的下一代NIDS嵌入的预训练数据包
FastPacket: Towards Pre-trained Packets Embedding based on FastText for next-generation NIDS
论文作者
论文摘要
攻击者每天都在越来越多地使用新的攻击，但其中许多攻击并未被入侵检测系统检测到，因为大多数ID忽略了原始数据包信息，并且仅关心从PCAP文件中提取的一些基本统计信息。使用网络程序从数据包中提取固定的统计功能是不错的，但可能还不足以检测到当今的挑战。我们认为现在是时候利用大数据和深度学习来从数据包中提取自动动态功能。现在是时候受到计算机视觉和自然语言处理的深度学习预训练模型的启发了，因此安全深度学习解决方案将在大型数据集上使用其预先培训的模型，以在未来的研究中使用。在本文中，我们提出了一种基于字符级嵌入的数据包的新方法，灵感来自文本数据上的FastText成功。我们称这种方法fastpacket。结果是在CIC-IDS-2017数据集的子集上测量的，但是我们希望大数据预训练的模型有希望的结果。我们建议在Mawi Big Dataset上构建预先训练的FastPacket，并将其提供给社区，类似于FastText。为了能够胜过当前使用NID，开始了可以更好地检测复杂攻击的数据包级NID的新时代。
New Attacks are increasingly used by attackers everyday but many of them are not detected by Intrusion Detection Systems as most IDS ignore raw packet information and only care about some basic statistical information extracted from PCAP files. Using networking programs to extract fixed statistical features from packets is good, but may not enough to detect nowadays challenges. We think that it is time to utilize big data and deep learning for automatic dynamic feature extraction from packets. It is time to get inspired by deep learning pre-trained models in computer vision and natural language processing, so security deep learning solutions will have its pre-trained models on big datasets to be used in future researches. In this paper, we proposed a new approach for embedding packets based on character-level embeddings, inspired by FastText success on text data. We called this approach FastPacket. Results are measured on subsets of CIC-IDS-2017 dataset, but we expect promising results on big data pre-trained models. We suggest building pre-trained FastPacket on MAWI big dataset and make it available to community, similar to FastText. To be able to outperform currently used NIDS, to start a new era of packet-level NIDS that can better detect complex attacks.
