  Network-based intrusion detection system (NIDS) monitors network traffic for
malicious activities, forming the frontline defense against increasing attacks
over information infrastructures. Although promising, our quantitative analysis
shows that existing methods perform inconsistently in declaring various unknown
attacks (e.g., 9% and 35% F1 respectively for two distinct unknown threats for
an SVM-based method) or detecting diverse known attacks (e.g., 31% F1 for the
Backdoor and 93% F1 for DDoS by a GCN-based state-of-the-art method), and
reveals that the underlying cause is entangled distributions of flow features.
This motivates us to propose 3D-IDS, a novel method that aims to tackle the
above issues through two-step feature disentanglements and a dynamic graph
diffusion scheme. Specifically, we first disentangle traffic features by a
non-parameterized optimization based on mutual information, automatically
differentiating tens and hundreds of complex features of various attacks. Such
differentiated features will be fed into a memory model to generate
representations, which are further disentangled to highlight the
attack-specific features. Finally, we use a novel graph diffusion method that
dynamically fuses the network topology for spatial-temporal aggregation in
evolving data streams. By doing so, we can effectively identify various attacks
in encrypted traffics, including unknown threats and known ones that are not
easily detected. Experiments show the superiority of our 3D-IDS. We also
demonstrate that our two-step feature disentanglements benefit the
explainability of NIDS.
