Mining Multi-Scale Spatial-Frequency Clues for Unsupervised Intrusion Detection

Unsupervised network-based intrusion detection system (UNIDS) identifies suspicious traffic and alerts administrators without using any traffic labels. Existing Graph Convolutional Network (GCN)-based UNIDS approaches show great potential with collaboratively utilizing traffic features and network topologies. However, these methods suffer from an excessively high false-positive rate (FPR), e.g., 3.27% FPR in a supervised NIDS approach, while increases dramatically to 19.37% under the unsupervised setting. We reveal that the high FPR stems from a single-scale spatial-frequency learning paradigm, which blurs the distinction between benign and malicious traffic and misleads UNIDS systems. Therefore, we propose a Multi-scale Spatial-Frequency Intrusion Detection System (MSF-IDS) to mitigate the high FPR. Specifically, we propose multi-scale frequency encoders, thereby differentiating abnormal feature patterns. Then we propose NAPH as a spatial encoder, mining intrinsic abnormal topology patterns by tracking tens of thousands of evolving traffic nodes. To the best of our knowledge, NAPH takes the first step toward differentiable persistent homology analysis over dynamic network data. We also develop an executable application for NAPH to provide easy-access visualization insights. Finally, a self-supervised representation augmentor and an intrusion detector are proposed to refine and highlight the attack-specific information. Equipped with MSF-IDS, administrators effectively identify the unknown attack traffic, freeing security staff from labor-intensive engineering. Extensive experiments demonstrate the superiority of MSF-IDS, including binary classification, multi-classification, online intrusion detection, and visualized discussions. Our codes, datasets, and an executable application are available at https://github.com/qcydm/MSF-IDS