  Network intrusion detection systems (NIDS) are one of many solutions that
make up a computer security system. Several machine learning-based NIDS have
been proposed in recent years, but most of them were developed and evaluated
under the assumption that the training context is similar to the test context.
In real networks, this assumption is false, given the emergence of new attacks
and variants of known attacks. To deal with this reality, the open set
recognition field, which is the most general task of recognizing classes not
seen during training in any domain, began to gain importance in NIDS research.
Yet, existing solutions are often bounded to high temporal complexities and
performance bottlenecks. In this work, we propose an algorithm to be used in
NIDS that performs open set recognition. Our proposal is an adaptation of the
single-class Energy-based Flow Classifier (EFC), which proved to be an
algorithm with strong generalization capability and low computational cost. The
new version of EFC correctly classifies not only known attacks, but also
unknown ones, and differs from other proposals from the literature by
presenting a single layer with low temporal complexity. Our proposal was
evaluated against well-established multi-class algorithms and as an open set
classifier. It proved to be an accurate classifier in both evaluations, similar
to the state of the art. As a conclusion of our work, we consider EFC a
promising algorithm to be used in NIDS for its high performance and
applicability in real networks.
