Method and system for adaptive network intrusion detection

2:

• The method according to claim 1, wherein the representation function is an autoencoder neural network.

3:

• The method according to claim 1, wherein the method further comprises:
• using live traffic for the traffic classification machine learning model and deploying the traffic classification machine learning model for examining the live traffic.

4:

• The method according to claim 3, wherein before using the live traffic for the traffic classification machine learning model, extracting features from the live traffic and modifying the live traffic's extracted features using the new representation of the unlabeled data learned in operation c).

5:

• The method according to claim 1, wherein operations c)-e) are repeated to adapt to network traffic changes.

6:

• The method according to claim 1, further comprising:
• collecting, by network mappers of a monitoring subsystem, information about network characteristics, comprising a network topology, available hosts, running services, open ports, operating systems, or potential vulnerabilities.

7:

• The method according to claim 6, further comprising, by the monitoring subsystem:
• determining, based on the collected information, a need for adaptation, and
• issuing an adaptation signal towards the network audit tool for triggering execution of operations c)-e).

8:

• The method according to claim 1, wherein the traffic classification machine learning model is based on a supervised learning method that uses of a support vector machine to deliver a multi-classification detection model.

10:

• The system of claim 9, further comprising:
• a planning subsystem that is configured to deploy the traffic classification machine learning model to examine live traffic on the network.

11:

• The system according to claim 10, wherein the planning subsystem is further configured to extract features from the live traffic and to modify the live traffic's extracted features using the new representation of the unlabeled data learned by the execution of the unsupervised feature learning algorithm, before using the live traffic for the traffic classification machine learning model.

12:

• The system according to claim 9, further comprising:
• a monitoring subsystem comprising one or more network mappers, the network mappers being configured to collect information about network characteristics, comprising a network topology, available hosts, running services, open ports, operating systems, or potential vulnerabilities.

13:

• The system according to claim 12, wherein the monitoring subsystem is further configured:
• to determine, based on the collected information, a need for adaptation, and
• to issue an adaptation signal towards the network audit tool for triggering activation of the representation function, the representation function preferably being an autoencoder neural network.

14:

• The system according to claim 9, further comprising:
• a repository that is configured to store network traffic collected by the network traffic capture system and to hold the labeled training set.

15:

• The system according to claim 9, further comprising a detection subsystem comprising:
• a network audit tool that is configured to receive network traffic and to translate received network traffic into machine learning-ready instances, and
• a feedforward autoencoder that is configured to receive the machine learning-ready instances from the network audit tool, and to acquire the same representation of the instances as the new training set, before the network traffic passes through a detection model.