Modern networks are characterized by continuous evolution and mutation of both normal and attack traffic. Thus, the proposed research will focus on proposing NIDS highly adaptive to their environment and aware of their interaction with potential attackers. We will start by formally characterizing situation awareness, knowledge and actions required to adapt ML-based NIDS. To reduce latency of NIDS updates, we will adopt active learning on incremental ML models like DNN. Thus, it is important to cover metrics related to learning activities like samples distribution (normal, abnormal, adversarial) in addition to performance metrics (e.g., accuracy and precision). Monitoring such metrics requires accurate and efficient online labeling techniques. We will adopt a hybrid approach where the majority of labels will be generated by automatic techniques like uncertainty sampling to avoid the limitations of human oracle labeling.
Adaptation actions will include, but not limited to, samples generation/selection, adversarial samples generation, ML model update, etc. An adaptation framework will be proposed by a) designing feedback architectures that will be tailored for managing supervised ML-based NIDS and capturing real time and adaptive actions. The expected contributions will be validated on public intrusion detection datasets.