Source-linked AI summary
Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection
Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, Asaf Shabtai
TL;DR
Simple network gateways need intrusion detection that avoids expensive offline training, extensive labeling, and resource-heavy ANN execution. Kitsune addresses this with an online unsupervised NIDS built from autoencoder ensembles and incremental traffic-feature tracking. It performs nearly as well as offline anomaly detectors, including on a Raspberry Pi, while supporting substantially higher packet-processing rates.
Problem
ANN-based NIDSs are difficult to deploy on simple gateways because training requires substantial resources and labeled traffic, while traffic and attack classes change over time.
Method
Kitsune combines incremental network-channel feature extraction with KitNET, an online ensemble of autoencoders that reconstruct traffic patterns for anomaly detection.
Results
Kitsune performed nearly as well as offline anomaly detectors, sometimes better, and an ensemble increased Raspberry Pi packet processing from approximately 1,000 to 5,400 packets per second.
Takeaways & Limitations
The results support deploying an efficient plug-and-play neural NIDS on simple network devices, including a single-core Raspberry Pi.
Takeaways & Limitations
When the target network may already be contaminated, the paper recommends considering a signature-based NIDS alongside Kitsune.
Abstract
from arXiv · showhide
Neural networks have become an increasingly popular solution for network intrusion detection systems (NIDS). Their capability of learning complex patterns and behaviors make them a suitable solution for differentiating between normal traffic and network attacks. However, a drawback of neural networks is the amount of resources needed to train them. Many network gateways and routers devices, which could potentially host an NIDS, simply do not have the memory or processing power to train and sometimes even execute such models. More importantly, the existing neural network solutions are trained in a supervised manner. Meaning that an expert must label the network traffic and update the model manually from time to time. In this paper, we present Kitsune: a plug and play NIDS which can learn to detect attacks on the local network, without supervision, and in an efficient online manner. Kitsune's core algorithm (KitNET) uses an ensemble of neural networks called autoencoders to collectively differentiate between normal and abnormal traffic patterns. KitNET is supported by a feature extraction framework which efficiently tracks the patterns of every network channel. Our evaluations show that Kitsune can detect various attacks with a performance comparable to offline anomaly detectors, even on a Raspberry PI. This demonstrates that Kitsune can be a practical and economic NIDS.
I. INTRODUCTION
Kitsune addresses the resource, labeling, and deployment constraints that make conventional ANN-based NIDSs impractical on simple network gateways. It uses online unsupervised learning with small autoencoder ensembles to detect anomalous traffic efficiently.
- Motivation: Distributed NIDS deployment can detect malicious traffic traversing internal networks, but economically scaling it requires inexpensive routers with limited hardware.Point deployment misses traffic traversing the network itself; distributed deployment connects multiple NIDSs to strategic routers and gateways.
- Motivation: Conventional ANN-based NIDSs require expert-labeled data, strong training hardware, and offline collection that may be infeasible for gateways processing millions of packets hourly.Remote training can introduce significant network overhead and does not scale.
- Motivation: Supervised classifiers are difficult to maintain because normal traffic is local, attacks evolve, and training data cannot reasonably include every malicious class.The paper characterizes classification as a closed-world approach to identifying concepts.
- Design requirements: ANN complexity grows exponentially with neuron count, restricting gateway architectures and input features, especially under high-velocity traffic.These constraints motivate ANN-based detectors that are online, unsupervised, and efficient.
- Approach: Kitsune uses an ensemble of small autoencoders that reconstruct traffic patterns, while KitNET computes individual RMSEs and combines them through an output autoencoder.At most one instance is stored during training; the maximum inputs per autoencoder trades detection performance for speed.
- Contributions: The paper contributes a lightweight plug-and-play NIDS, incremental feature extraction, online unsupervised ensemble construction, and experiments spanning operational networks and attacks.The contributions include a generic online unsupervised anomaly-detection algorithm and runtime evaluation on simple devices.
III. BACKGROUND: AUTOENCODERS
Autoencoders are neural networks that transform inputs through sequential layers and are trained to reconstruct those inputs. Their layered forward propagation produces the final output used for reconstruction.
- Autoencoders are introduced as neural networks whose layers are connected sequentially through weighted synapses.
- The visible layer receives a numerical feature vector, while subsequent layers transform it through hidden representations.
- Forward propagation activates each successive layer using the previous layer’s outputs, weights, biases, and activation function.
- The full forward-propagation function h maps an input vector x to the final output y′.
C. Training an ANN
ANN training adjusts model parameters using prediction errors. Kitsune uses stochastic training so each arriving instance produces one update and is then discarded, supporting online operation.
- Training tunes ANN weights and biases so forward propagation maps instances x to expected outputs y.
- Back-propagation propagates output errors backward through the network, while gradient descent incrementally updates weights and biases.
- Stochastic gradient descent updates parameters from individual instances, initially converging faster than batch gradient descent.
- Kitsune uses SGD with a maximum of one iteration, learning once from each arriving instance and discarding it afterward.
D. Autoencoders
Autoencoders learn to reconstruct their inputs, making reconstruction error a signal for anomaly detection. KitNET constrains these networks to keep execution and training computationally manageable.
- An autoencoder is trained with identical inputs and targets, learning to reconstruct the original data.
- A bottleneck hidden layer forces compact encodings and decodings, encouraging the network to learn relationships among input features.
- Instances unlike the training distribution are expected to produce higher reconstruction error, measured using RMSE between input and reconstructed output.
- Anomaly detection trains on clean data, updates a threshold from training errors, and alerts when an unseen instance exceeds the sensitivity-scaled threshold.
- KitNET limits each autoencoder to three layers and at most seven visible neurons to reduce computational expense.
A. Overview
Kitsune combines packet-derived feature extraction with an online ensemble of small autoencoders for resource-constrained network anomaly detection. Its feature framework uses damped incremental statistics to track recent channel behavior with bounded per-update complexity.
- A. Overview: Kitsune monitors recent traffic patterns and detects abnormal behavior through an ensemble of autoencoders designed for simple routers and real-time operation.
- A. Overview: The framework includes packet capture, packet parsing, feature extraction, feature mapping, and anomaly detection components.
- A. Overview: KitNET is task-generic in its feature-mapping and anomaly-detection components, while parameter m trades detection rate against packet processing rate.
- B. Feature Extractor (FE): Feature extraction converts packet metadata into more than 100 statistics describing the current state of the originating network channel.
- B. Feature Extractor (FE): The feature extractor addresses interleaved channels, many simultaneous streams, and high packet rates that make per-channel packet windows impractical.
- B. Feature Extractor (FE): Damped incremental statistics reduce older observations over time, preserve recent behavior, and allow stale statistics to be deleted when their weight reaches zero.
- B. Feature Extractor (FE): The feature framework maintains statistics in a hash table with O(1) complexity and also captures relationships between receive and transmit traffic.
C. Feature Mapper (FM)
The Feature Mapper incrementally clusters network features into bounded subspaces, mapping each feature exactly once to an autoencoder-sized group. It uses correlation distances and summary statistics so mapping remains suitable for online, on-site processing.
- The Feature Mapper maps n input features into k smaller sub-instances, one for each autoencoder in the Ensemble Layer.
- Each sub-instance contains at most m features, every input feature is mapped exactly once, and the mapping is discovered online.
- Features are incrementally clustered into groups no larger than m using agglomerative hierarchical clustering on summary data.
- Correlation distance is used to group dimensions whose patterns capture normal behavior in related feature subspaces.
- The algorithm never stores more than one instance, uses O(n^2) memory during training, and updates a small n-by-n distance matrix.
D. Anomaly Detector (AD)
KitNET detects anomalies with two layers of autoencoders: an ensemble models separate feature subspaces, while an output autoencoder combines their reconstruction errors into a final score. It trains online and unsupervised on normal data, then performs forward propagation without updating parameters.
- KitNET consists of an Ensemble Layer and an Output Layer, both built from autoencoders for online unsupervised anomaly detection.
- The Ensemble Layer contains k small autoencoders that learn normal behavior in separate subspaces and report RMSE errors to the Output Layer.
- The Output Layer learns normal ensemble RMSE patterns and produces an anomaly score using relationships among subspace abnormalities and network noise.
- KitNET must be trained on normal data without attacks, although filtering methods can reduce the impact of preexisting attacks in training data.
- During execution, KitNET leaves internal parameters unchanged, propagates the mapped instance through both layers, and returns the Output Layer’s RMSE.
E. Complexity
KitNET’s complexity depends on the number of feature subspaces and is designed to scale favorably when the Feature Mapper forms bounded groups. Its ensemble layer scales linearly with the feature count, while the output layer depends on the number of autoencoders.
- The Ensemble Layer has execution complexity O(km^2), while the Output Layer has complexity O(k^2), with m treated as a constant.
- The Ensemble Layer’s complexity scales linearly with n, whereas the Output Layer’s complexity depends on the number of autoencoder subspaces selected by the Feature Mapper.
- When nearly every feature receives its own autoencoder, k = n and KitNET becomes equivalent to a single wide autoencoder with no performance gain.
- The worst-case mapping is rare on natural datasets because it requires a completely imbalanced clustering dendrogram.
- Training KitNET has complexity O(k^2) because each instance is learned from once.
V. EVALUATION
The evaluation section describes an assessment of Kitsune’s detection and runtime performance, covering datasets, experimental setup, and results.
- The evaluation measures Kitsune’s detection and runtime performance across datasets, experimental setup, and reported results.
A. Datasets
Kitsune was evaluated on a video-surveillance network and a noisier IoT network, using attacks targeting availability, integrity, and malware behavior.
- The surveillance dataset used two deployments of four HD cameras connected to DVRs through a site-to-site VPN.
- The evaluation focused on attacks affecting video-uplink availability and integrity, including SYN floods and man-in-the-middle video injection.
- A Raspberry Pi 3B served as a physical network bridge for the active wiretap setup.
- Feature extraction could capture some attacks indirectly through statistical changes, such as altered packet timing during man-in-the-middle attacks.
- The additional IoT dataset contained 9 IoT devices and 3 PCs, including a security camera infected with real Mirai malware.
B. Experiment Setup
The experiments compared Kitsune with online, offline, and signature-based detectors using common packet features, controlled training and execution periods, and multiple detection metrics.
- Offline algorithms served as an upper-bound perspective, while online algorithms provided the relevant baseline for Kitsune.
- The comparison included Suricata, Isolation Forests, Gaussian Mixture Models, incremental GMM, and pcStream2.
- Each algorithm trained on the first million packets and executed on the remaining packets using identical features.
- Detection was measured with TPR and FNR at FPR = 0.001, alongside zero-FPR true positives, AUC, and EER.
- Kitsune performed better than GMM on active-wiretap detection and achieved better EER than GMM on six listed datasets.
- Kitsune outperformed incremental GMM and pcStream2 in AUC and EER, while detection quality traded off against the ensemble parameter m.
E. Runtime Performance
Runtime benchmarks examined KitNET’s ensemble efficiency on a Raspberry Pi and Ubuntu VM, showing substantially higher packet rates with an ensemble and identifying operational caveats.
- The ensemble of small autoencoders reduces the operations required to process each instance compared with a single autoencoder.
- Benchmarks used C++, 198 statistical packet features, and one physical or logical CPU core on a Raspberry Pi 3B and Ubuntu VM.
- With k = 35, packet processing increased fivefold to approximately 5,400 packets per second on the Pi and 37,300 on the PC.
- Using an ensemble also reduced variance in Raspberry Pi processing times, which may benefit applications where network jitter is undesirable.
- The benchmark supports running Kitsune on a resource-limited router, although the experiments used one core and parallelization was left for future work.
- A contaminated network can let an adversary influence train-mode, and feature-extraction flooding can consume memory through many incremental statistics.