ALADIN: Active Learning for Statistical Intrusion Detection

To create host-based or network-based intrusion detection systems, we propose ALADIN which stands for “Active Learning of Anomalies to Detect INtrusions”. ALADIN uses active learning combined with rare class discovery and uncertainty identification to statistically train an intrusion detection or prevention system (IDS/IPS). Active learning selects “interesting traffic” to be shown to a security expert for labeling to substantially reduce the number of labels required from an expert to reach an acceptable level of accuracy and coverage.