Unknown network attack detection based on open-set recognition and active learning in drone network

With the technical support of 5G, the drone network plays a critical role in the autonomous and digital era. However, due to wireless and autonomy characteristics, the drone network is prone to diverse malicious attacks, so it's vital to deploy network intrusion detection system to detect network attacks. For a real open drone network environment, unknown attacks will occur constantly, but the existing intrusion detection methods are usually designed for a static and closed-set scenario and will fail to recognize the unknown attacks correctly, threatening the security of drone network. Therefore, we design an intrusion detection system to detect unknown network attacks in the drone network. Based on open-set recognition, we propose the Open-CNN model to implement intrusion detection and detect unknown attacks. Further to detect unknown attacks, we also propose an active learning (AL) approach for unknown attacks based on the least confidence query strategy, allowing the intrusion detection model to learn efficiently from the unknown attack instances detected by Open-CNN at small labeling budgets. Extensive experiments demonstrate the effectiveness of Open-CNN in detecting unknown attacks, with the accuracy improvement of 9% to 30% over the compared methods, and the proposed AL approach achieves good performance when retraining with only 1% of labeled unknown attack samples.