nNFST: A single-model approach for multiclass novelty detection in network intrusion detection systems

Abstract

The rapid evolution of cyberattack techniques necessitates advanced intrusion detection systems (IDS) capable of multiclass novelty detection (MND), accurately classifying known attacks while identifying novel ones. Despite numerous successful studies focused on multi-class attack classification or novel attack detection separately, a significant research gap remains in achieving the effective MND for IDS. In this paper, we introduce the neighbour null Foley-Sammon transformation (nNFST), a novel single-model algorithm designed to address the MND challenge in IDS. nNFST employs a novel technique based on the inverse nearest neighbour algorithm to compute within-class and between-class variation. This technique preserves both the local distribution structure within each class and the global distribution structure across classes, thereby mitigating the impact of singular points on the algorithm and …