# usfAD Based Effective Unknown Attack Detection Focused IDS Framework

arXiv: https://arxiv.org/abs/2403.11180 · HTML: https://mlsanity.com/paper/2403.11180/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 72 references that are in the map.
- First posted on arXiv 17 Mar 2024.

## Builds on (most cited first, 14 of 14)

- [PyOD: A Python Toolbox for Scalable Outlier Detection](https://mlsanity.com/paper/1901.01588/) (2019)
- [One-Class Classification: Taxonomy of Study and Review of Techniques](https://mlsanity.com/paper/1312.0049/) (2013)
- [Detection of False Data Injection Attacks in Smart Grid: A Secure Federated Deep Learning Approach](https://mlsanity.com/paper/2209.00778/) (2022)
- [Multi-Stage Optimized Machine Learning Framework for Network Intrusion Detection](https://mlsanity.com/paper/2008.03297/) (2020)
- [Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction](https://mlsanity.com/paper/2401.12262/) (2024)
- [A Survey on Device Behavior Fingerprinting: Data Sources, Techniques, Application Scenarios, and Datasets](https://mlsanity.com/paper/2008.03343/) (2020)
- [A Dependable Hybrid Machine Learning Model for Network Intrusion Detection](https://mlsanity.com/paper/2212.04546/) (2022)
- [Deep learning based on Transformer architecture for power system short-term voltage stability assessment with class imbalance](https://mlsanity.com/paper/2310.11690/) (2023)
- [MLSTL-WSN: Machine Learning-based Intrusion Detection using SMOTETomek in WSNs](https://mlsanity.com/paper/2402.13277/) (2024)
- [Localization of Dummy Data Injection Attacks in Power Systems Considering Incomplete Topological Information: A Spatio-Temporal Graph Wavelet Convolutional Neural Network Approach](https://mlsanity.com/paper/2401.15321/) (2024)
- [Securing Transactions: A Hybrid Dependable Ensemble Machine Learning Model using IHT-LR and Grid Search](https://mlsanity.com/paper/2402.14389/) (2024)
- [Host-based anomaly detection using Eigentraces feature extraction and one-class classification on system call trace data](https://mlsanity.com/paper/1911.11284/) (2019)
- [Active and Passive Hybrid Detection Method for Power CPS False Data Injection Attacks with Improved AKF and GRU-CNN](https://mlsanity.com/paper/2202.06722/) (2022)
- [GowFed -- A novel Federated Network Intrusion Detection System](https://mlsanity.com/paper/2210.16441/) (2022)

## Built on by (most cited first, 2 of 2)

- [A Scalable Hierarchical Intrusion Detection System for Internet of Vehicles](https://mlsanity.com/paper/2505.16215/) (2025)
- [A Hierarchical IDS for Zero-Day Attack Detection in Internet of Medical Things Networks](https://mlsanity.com/paper/2508.10346/) (2025)

## Abstract (arXiv)

The rapid expansion of varied network systems, including the Internet of Things (IoT) and Industrial Internet of Things (IIoT), has led to an increasing range of cyber threats. Ensuring robust protection against these threats necessitates the implementation of an effective Intrusion Detection System (IDS). For more than a decade, researchers have delved into supervised machine learning techniques to develop IDS to classify normal and attack traffic. However, building effective IDS models using supervised learning requires a substantial number of benign and attack samples. To collect a sufficient number of attack samples from real-life scenarios is not possible since cyber attacks occur occasionally. Further, IDS trained and tested on known datasets fails in detecting zero-day or unknown attacks due to the swift evolution of attack patterns. To address this challenge, we put forth two strategies for semi-supervised learning based IDS where training samples of attacks are not required: 1) training a supervised machine learning model using randomly and uniformly dispersed synthetic attack samples; 2) building a One Class Classification (OCC) model that is trained exclusively on benign network traffic. We have implemented both approaches and compared their performances using 10 recent benchmark IDS datasets. Our findings demonstrate that the OCC model based on the state-of-art anomaly detection technique called usfAD significantly outperforms conventional supervised classification and other OCC based techniques when trained and tested considering real-life scenarios, particularly to detect previously unseen attacks.