CVAE-AN: Atypical Attack Flow Detection Using Incremental Adversarial Learning

Network Intrusion Detection Systems (NIDS) are powerful tools for identifying and deterring cybersecurity attacks nowadays. However, while these modern IDS can detect typical attacks, recent studies show their poor performances in identifying unknown or dynamically changing atypical attacks. Another issue with the training aspect of such systems is the problem of class imbalance which impedes their performance, especially for minority attack classes. This renders IDS systems vulnerable to both adversarial as well as non-AI synthesized atypical attacks when deployed in a real network. To reduce misclassification (especially for minority classes) and detect atypical attack flows, we propose a novel adversarial incremental learning approach based on a hybrid model consisting of a Conditional Variational Autoencoder (CVAE) and a Generative Adversarial Network (GAN) namely, CVAE-Adversarial Network (CVAE-AN). The binary IDS has been trained using the CICIDS2017 dataset and evaluated using multiple atypical attacks. Simulation results demonstrate that the proposed technique significantly improves the performance of the IDS against different atypical attacks and outperforms the state-of-the-art detection models as well as class balancing methods.