LCHI: Low-Order Correlation and High-Order Interaction Integrated Model Oriented to Network Intrusion Detection

Figure 1

Current situation of feature interaction in network intrusion detection. The problems lie in (1) single low- or high-order feature interaction extraction and (2) too much noise while extracting all possible low-order feature interactions indiscriminately. In subfigure (c), the value is the correlation of by the MCA model [7]; the value (interaction among the ) is the 3-layer output of the DNN model. In subfigure (d), the PR denotes the polynomial regression [30], and the FM denotes the factorization machines [27].

(a) The diagram in different attack scenarios

(b) Typical model of low- or high-order feature interaction

(c) Image effect of single low- or high-order feature interaction

(d) Detection accuracy (%) of single low- or high-order interaction