Semi-WTC: A Practical Semi-supervised Framework for Attack Categorization through Weight-Task Consistency
Supervised learning has been widely used for attack detection, which requires
large amounts of high-quality data and labels. However, the data is often
imbalanced and sufficient annotations are difficult to obtain. Moreover, these
supervised models are subject to real-world deployment issues, such as
defending against unseen artificial attacks. We propose a semi-supervised
fine-grained attack categorization framework consisting of an encoder and a
two-branch structure to integrate information from labeled and unlabeled data
to tackle these practical challenges. This framework can be generalized to
different supervised models. The multilayer perceptron with residual connection
and batch normalization is used as the encoder to extract features and reduce
the complexity. The Recurrent Prototype Module (RPM) is proposed to train the
encoder effectively in a semi-supervised manner. To alleviate the problem of
data imbalance, we introduce the Weight-Task Consistency (WTC) into the
iterative process of RPM by assigning larger weights to classes with fewer
samples in the loss function. In addition, to cope with new attacks in
real-world deployment, we further propose an Active Adaption Resampling (AAR)
method, which can better discover the distribution of the unseen sample data
and adapt the parameters of the encoder. Experimental results show that our
model outperforms the state-of-the-art semi-supervised attack detection methods
with a general 5% improvement in classification accuracy and a 90% reduction in
training time.