DAS-Gen: Continual Signature Generation for Evolving Malicious Traffic

In recent years, with the increasing popularity of network application, the number of cyber threats have surged significantly. Signature-based approach remains widely-used due to its low resource consumption. Various automatic signature generation methods for malicious traffic are proposed to improve the efficiency of signature generation and reduces the need for human intervention, especially based on XAI. However, signature system faces concept drift challenges due to the evolution nature of cyber threats and the ever-changing patterns of malicious traffic, resulting the degradation of detection performance under practical setting. In this paper, we propose a drift-aware and incremental learning-based framework for continual signature generation to improve the adaption of signatures and further improve classification performance, named DAS-Gen. A collaborative drift detection method is proposed to uncover potential concept drifts and a SMOTE-based method is carried out to adapt the signature generation model to the pattern changes of streaming malicious traffic. Experiments on two public datasets show proposed DAS-Gen is capable of swiftly detecting concept drift and adapting to the drifting data compared against other state-of-the-art approaches, enabling the generation of more effective signatures for updating the signature repository.