The proliferation of zero-day threats (ZDTs) to companies' networks has been
immensely costly and requires novel methods to scan traffic for malicious
behavior at massive scale. The diverse nature of normal behavior along with the
huge landscape of attack types makes deep learning methods an attractive option
for their ability to capture highly-nonlinear behavior patterns. In this paper,
the authors demonstrate an improvement upon a previously introduced
methodology, which used a dual-autoencoder approach to identify ZDTs in network
flow telemetry. In addition to the previously-introduced asset-level graph
features, which help abstractly represent the role of a host in its network,
this new model uses metric learning to train the second autoencoder on labeled
attack data. This not only produces stronger performance, but it has the added
advantage of improving the interpretability of the model by allowing for
multiclass classification in the latent space. This can potentially save human
threat hunters time when they investigate predicted ZDTs by showing them which
known attack classes were nearby in the latent space. The models presented here
are also trained and evaluated with two more datasets, and continue to show
promising results even when generalizing to new network topologies.

该篇论文利用双自编码器 [dual-autoencoder] 和度量学习 [metric learning] 方法，通过资产级图谱特征 [asset-level graph features] 检测网络流量中的零日威胁 [zero-day threats]，在已知攻击类型的情况下实现多类分类 [multiclass classification]，可在潜在空间 [latent space] 中显示最近的已知攻击类别类，有望为威胁猎人节省时间。