Communication Dans Un Congrès Année : 2025

TATA: Benchmark NIDS Test Sets Assessment and Targeted Augmentation

Résumé

Research works on Network Intrusion Detection Systems (NIDSs) using Machine Learning (ML) usually reports very high detection rate, often well above 90%. However, these results typically originate from overly simplistic NIDS datasets, where the test set, often just a subset of the overall dataset, mirrors the training set distribution, failing to rigorously assess the NIDS's robustness under more varied conditions. To address this shortcoming, we propose a method for Test sets Assessment and Targeted Augmentation (TATA). TATA is a model-agnostic approach that assesses and augments the quality of benchmark ML-based NIDS test sets. First, TATA encodes both training and test sets in a structured latent space via a contrastive autoencoder, defining three quality metrics (diversity, proximity, and scarcity) to identify test set gaps where the ML-based classification is harder. Next, TATA employs a reinforcement learning (RL) approach guided by these metrics, configuring a testbed that produces realistic data specifically targeting these gaps, creating a more robust test set. Using CIC-IDS2017 and CSE-CIC-IDS2018, we observe a positive correlation between higher metric values and increased detection difficulty, confirming their utility as meaningful indicators of test set robustness. With the same datasets, TATA's RLbased augmentation significantly raises detection difficulty for multiple NIDS models, revealing previously overlooked weaknesses.

Domaines

Fichier principal
Vignette du fichier
TATA.pdf (1.07 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Licence

Dates et versions

hal-05148383 , version 1 (07-07-2025)

Licence

Identifiants

  • HAL Id : hal-05148383 , version 1

Citer

Omar Anser, Jérôme François, Isabelle Chrisment, Daishi Kondo. TATA: Benchmark NIDS Test Sets Assessment and Targeted Augmentation. ESORICS 2025 - 30th European Symposium on Research in Computer Security, Sep 2025, Toulouse, France. ⟨hal-05148383⟩
435 Consultations
548 Téléchargements

Partager

  • More