AA-HMM: An Anti-Adversarial Hidden Markov Model for Network-Based Intrusion Detection

Abstract

In the field of network intrusion, malware usually evades anomaly detection by disguising malicious behavior as legitimate access. Therefore, detecting these attacks from network traffic has become a challenge in this an adversarial setting. In this paper, an enhanced Hidden Markov Model, called the Anti-Adversarial Hidden Markov Model (AA-HMM), is proposed to effectively detect evasion pattern, using the Dynamic Window and Threshold techniques to achieve adaptive, anti-adversarial, and online-learning abilities. In addition, a concept called Pattern Entropy is defined and acts as the foundation of AA-HMM. We evaluate the effectiveness of our approach employing two well-known benchmark data sets, NSL-KDD and CTU-13, in terms of the common performance metrics and the algorithm’s adaptation and anti-adversary abilities.

Keywords

• network intrusion detection
• adversarial setting
• Anti-Adversarial Hidden Markov Model (AA-HMM)
• evasion patterns
• dynamic window (DW)
• threshold (TH)
• pattern entropy (PE)
• adaptability