An Adaptive Deep Learning Framework for Zero-Day Cyberattack Detection Using Behavioral Intelligence

Abstract

 The rapid development of networked systems has made the digital infrastructure more susceptible to sophisticated cyber-attacks, especially zero-day attacks, which use unseen security vulnerabilities. Conventional security systems depend largely upon the use of attack signatures, which are ineffective against unseen attacks. To overcome the inefficiency of conventional security systems, this paper proposes a framework for anomaly detection based on the use of deep learning techniques, especially the use of the Auto encoder, which learns the normal behavior of the network instead of learning the patterns of attacks. In the proposed framework, the Auto encoder, which is a type of neural network, is trained using only the normal behavior of the network. The use of the Auto encoder helps the framework to identify anomalies based on the behavior of the network. To improve the accuracy of the framework, the output of the Auto encoder is passed through a Random Forest classifier. To improve the accuracy of the framework, a probability-based threshold optimization strategy is used. Moreover, the use of the Auto encoder is combined with the use of the isolation-based anomaly detection method to improve the accuracy of the framework. In addition, federated learning is integrated to facilitate the training of the model by more than one organization without the need to share the raw network data, thus ensuring the privacy of the users. Moreover, explainable artificial intelligence is utilized, such as the SHAP method, which aids the users in getting the required information regarding the features. This helps the users understand the decision-making process of the anomaly detection method. Experimental results using the UNSW-NB15 dataset prove the efficiency of the proposed framework, where the accuracy is found to be 95.19%, thus ensuring the detection of unseen cyber-attacks.