Exploratory Detection of Unknown Cyber-Attacks via Evolutionary Strategy and Machine Learning

With the open-source development of cyber-attack technologies, attackers’ ability to modify existing strategies and exploit vulnerabilities has increased, leading to numerous unknown cyber-attacks. Traditional detection methods face two main challenges: (a) requiring abundant labeled attack samples, which deep learning-based detection methods find difficult to obtain in practice, and (b) struggling to effectively detect novel and previously unseen attacks, especially those that are unknown. In this paper, we propose Exploratory Detection of Unknown Cyber-Attacks via Evolutionary Strategy and Machine Learning. Specifically, firstly, we train kernel-based Ramp-OCSVM models on full features of known attacks to derive class-specific thresholds, while inferring unknown attack thresholds via Gaussian distribution. Next, we define known sample features as “genes” and generate evolutionary feature representations through multi-strategy evolution. Subsequently, these features are processed by the trained Ramp-OCSVM and the thresholds to separate known-attack variants from unknown samples. Finally, we iteratively train a RF classifier using evolved features, selecting the optimal iteration-trained model based on detection performance. We conducted extensive experiments on authoritative datasets. The results achieves F1 scores of 82.70% and 87.64% for detecting unknown attack under different configurations. The mean F1 scores improve to 99.84% and 95.80% for detecting known and unknown attacks in the few-shot learning scenario. Compared to SOTA methods, our proposed method achieves an increase of 2.19% in the F1 score, while demonstrating 53.99% higher F1-score than detection methods via GAN and VAE.