Lifelong learning based intelligent, diverse, agile, and robust system for network attack detection

A method, comprising

• capturing network data directed to a host node, the host node comprising a honeypot, the honeypot configured to emulate operation of a physical or virtual device to attract malicious activity;
• classifying, based on a supervised machine learning model, the network data as being malicious or not malicious;
• and
• classifying, based on an unsupervised machine learning model, the network data as being anomalous or not anomalous;
• after classifying the network data with the supervised and unsupervised machine learning model:
• altering operation of the honeypot;
• determining, after operation of the honeypot is altered, the honeypot is accessed;
• and
• retraining, in response to the honeypot being accessed, at least one of the supervised machine learning model and unsupervised machine learning model with features from the network data.

A non-transitory computer readable storage medium comprising:

• A plurality of instructions executable by a processor, the instructions comprising:
• instructions executable by the processor to capture network data directed to a host node, the host node comprising a honeypot, the honeypot configured to emulate operation of a physical or virtual device to attract malicious activity;
• and
• instructions executable by the processor to classify, based on a supervised machine learning model, the network data as being malicious or not malicious;
• instructions executable by the processor to classify, based on an unsupervised machine learning model, the network data as being anomalous or not anomalous;
• instructions executable by the processor to enhance the supervised machine learning model and unsupervised machine learning model, the instructions comprising:
• instructions executable by the processor to alter operation of the honeypot;
• instructions executable by the processor to determine, after operation of the honeypot is altered, the honeypot is accessed;
• and
• instructions executable by the processor to retrain the supervised machine learning model and the unsupervised machine learning model with features from the network data in response to the honeypot being accessed.