ILAB: An Interactive Labelling Strategy for Intrusion Detection

Anaël Beaugnon (1, 2, 3) , Pierre Chifflier (1) , Francis Bach (2, 3)

1 ANSSI - Agence nationale de la sécurité des systèmes d'information
2 LIENS - Laboratoire d'informatique de l'école normale supérieure
3 SIERRA - Statistical Machine Learning and Parsimony

Acquiring a representative labelled dataset is a hurdle that has to be overcome to learn a supervised detection model. Labelling a dataset is particularly expensive in computer security as expert knowledge is required to perform the annotations. In this paper, we introduce ILAB, a novel interactive labelling strategy that helps experts label large datasets for intrusion detection with a reduced workload. First, we compare ILAB with two state-of-the-art labelling strategies on public labelled datasets and demonstrate it is both an effective and a scalable solution. Second, we show ILAB is workable with a real-world annotation project carried out on a large unlabelled NetFlow dataset originating from a production environment. We provide an open source implementation (https://github.com/ANSSI-FR/SecuML/) to allow security experts to label their own datasets and researchers to compare labelling strategies.

Mots clés: Intrusion Detection; Active Learning; Rare Category Detection

Domaines: Intelligence artificielle [cs.AI]; Apprentissage [cs.LG]; Cryptographie et sécurité [cs.CR]

Anaël Beaugnon, Pierre Chifflier, Francis Bach. ILAB: An Interactive Labelling Strategy for Intrusion Detection. RAID 2017: Research in Attacks, Intrusions and Defenses, Sep 2017, Atlanta, United States. ⟨hal-01636299⟩