TAD-FC: An Adaptive Network Attack Detection and Feature Capture Approach for Real-World Network Environments

To address the limitations of existing network attack detection methods, which often rely on static security rules and exhibit limited adaptability in real-world network environments, we propose an Adaptive Network Attack Detection and Feature Capture Framework (TAD-FC). This paper designs an “attack detection-feature capture-rule update” structure to facilitate the adaptive updating of rules and proposes a mechanism based on Bayesian theory to optimize the adjustment threshold to accommodate new patterns in attack traffic distributions. The framework employs a two-stage attack detection mechanism to effectively respond to evolving attack methodologies. In the first stage, CASI is proposed to identify mutated attacks similar to known covert threats and the sparse group sparse lasso method is used for feature location and capture. In the second stage, an incremental decision tree based on pseudo-labeling of latent features identifies novel attacks, then the feature importance distribution and incremental decision tree abnormal splitting path are used to determine the attack features. Experimental results show strong performance on datasets such as CIC-DDoS 2019, NSL-KDD, and CIC-IDS 2018, achieving 95.12% accuracy on CST-Cloud traffic.