Abstract: A method adapts network intrusion detection. The method includes: a) deploying a network traffic capture system and collecting network packet traces; b) using a network audit tool, extracting features from the collected network packet traces; c) feeding the extracted features as unlabeled data into a representation function, and, utilizing the representation function as an unsupervised feature learning algorithm, learning a new representation of the unlabeled data; d) providing a labeled training set capturing examples of malicious network traffic, and, using the learned new representation of the unlabeled data, modifying the labeled training set to obtain a new training set; and e) using the new training set, training a traffic classification machine learning model.

Abstract: A method adapts network intrusion detection. The method includes: a) deploying a network traffic capture system and collecting network packet traces; b) using a network audit tool, extracting features from the collected network packet traces; c) feeding the extracted features as unlabeled data into a representation function, and, utilizing the representation function as an unsupervised feature learning algorithm, learning a new representation of the unlabeled data; d) providing a labeled training set capturing examples of malicious network traffic, and, using the learned new representation of the unlabeled data, modifying the labeled training set to obtain a new training set; and e) using the new training set, training a traffic classification machine learning model.

Abstract: A detection rules generation engine includes an initial population creation subsystem configured to receive filtered network traffic instances from a network tap and to build an initial population of decision trees having nodes which are sorted based on an information gain of network features of the traffic instances. A parents selection subsystem is configured to select two individuals from the population based on a selection probability. A depth selection subsystem is configured to select a depth among the nodes of the decision trees. A parents crossover subsystem is configured to apply a crossover operation on the selected individuals. A parents mutation subsystem is configured to apply a mutation operation on the selected individuals. A population replacement subsystem is configured to generate a next population.

Abstract: A detection rules generation engine includes an initial population creation subsystem configured to receive filtered network traffic instances from a network tap and to build an initial population of decision trees having nodes which are sorted based on an information gain of network features of the traffic instances. A parents selection subsystem is configured to select two individuals from the population based on a selection probability. A depth selection subsystem is configured to select a depth among the nodes of the decision trees. A parents crossover subsystem is configured to apply a crossover operation on the selected individuals. A parents mutation subsystem is configured to apply a mutation operation on the selected individuals. A population replacement subsystem is configured to generate a next population.