A training-resistant anomaly detection system - Archive ouverte HAL Access content directly
Journal Articles Computers & Security Year : 2018

A training-resistant anomaly detection system


Modern network intrusion detection systems rely on machine learning techniques to detect traffic anomalies and thus intruders. However, the ability to learn the network behaviour in real-time comes at a cost: malicious software can interfere with the learning process, and teach the intrusion detection system to accept dangerous traffic. This paper presents an intrusion detection system (IDS) that is able to detect common network attacks including but not limited to, denial-of-service, bot nets, intrusions, and network scans. With the help of the proposed example IDS, we show to what extent the training attack (and more sophisticated variants of it) has an impact on machine-learning based detection schemes, and how it can be detected.

Dates and versions

hal-01836374 , version 1 (12-07-2018)



Steve Muller, Jean Lancrenon, Carlo Harpes, Yves Le Traon, Sylvain Gombault, et al.. A training-resistant anomaly detection system. Computers & Security, 2018, 76, pp.1-11. ⟨10.1016/j.cose.2018.02.015⟩. ⟨hal-01836374⟩
189 View
0 Download



Gmail Mastodon Facebook X LinkedIn More