A Class Incremental Learning Framework for DDoS Detection

In a constantly evolving environment, such as a Network environment, an Anomaly-based Network Intrusion Detection System (A-NIDS) must be capable of continuously adapting without forgetting previously learned tasks, thereby avoiding the phenomenon of Catastrophic Forgetting (CF) of old threats. In anomaly-based or fault detection systems, datasets are usually highly unbalanced, making the development of a classifier more challenging. In this scenario, a possible solution to mitigate these issues is Class Incremental Learning (CIL). In this work, a CIL Framework for an A-NIDS dedicated to denial of services attacks has been developed using the CICDDoS2019 dataset, synthesizing a Pseudo-Rehearsal strategy to mitigate CF. Every time a new class is added, a class model is trained with both real and generated samples. Different generative models have been tested to evaluate the one better suited to the problem at hand. Our tests show that the Gaussian Mixture Model is the best-performing one. Additionally, an analysis over the considered dataset has been performed, showing similar issues affecting CICIDS2017. Results indicate a minimal performance degradation with the usage of generated samples.