A Novel Solution for Zero-Day Attack Detection in IDS using Self-Attention and Jensen-Shannon Divergence in WGAN-GP

2026-03-19

AI Summary

This work addresses the challenge of detecting zero-day attacks, which exploit previously unknown vulnerabilities and thus evade conventional intrusion detection systems (IDS). To this end, the authors propose SA-JS-WGAN-GP, a novel approach that integrates self-attention mechanisms with a Jensen-Shannon divergence-based auxiliary discriminator within the WGAN-GP framework. This integration effectively captures long-range dependencies among network traffic features and enhances both the quality and diversity of generated synthetic samples. Evaluated on the NSL-KDD dataset using binary cross-entropy loss and a leave-one-attack-type-out strategy, the proposed method significantly outperforms existing baselines, demonstrating a marked improvement in the generalization capability of IDS against zero-day attacks.

Technology Category

• Computer Vision: Generative Adversarial Networks (GANs) for Vision
• Machine Learning: Deep Generative Models & Autoencoders
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

The increasing sophistication of cyber threats, especially zero-day attacks, poses a significant challenge to cybersecurity. Zero-day attacks exploit unknown vulnerabilities, making them difficult to detect and defend against. Existing approaches patch flaws and deploy an Intrusion Detection System (IDS). Using advanced Wasserstein GANs with Gradient Penalty (WGAN-GP), this paper makes a novel proposition to synthesize network traffic that mimics zero-day patterns, enriching data diversity and improving IDS generalization. SA-WGAN-GP is first introduced, which adds a Self-Attention (SA) mechanism to capture long-range cross-feature dependencies by reshaping the feature vector into tokens after dense projections. A JS-WGAN-GP is then proposed, which adds a Jensen-Shannon (JS) divergence-based auxiliary discriminator that is trained with Binary Cross-Entropy (BCE), frozen during updates, and used to regularize the generator for smoother gradients and higher sample quality. Third, SA-JS-WGAN-GP is created by combining the SA mechanism with JS divergence, thereby enhancing the data generation ability of WGAN-GP. As data augmentation does not equate with true zero-day attack discovery, we emulate zero-day attacks via the leave-one-attack-type-out method on the NSL-KDD dataset for training all GANs and IDS models in the assessment of the effectiveness of the proposed solution. The evaluation results show that integrating SA and JS divergence into WGAN-GP yields superior IDS performance and more effective zero-day risk detection.

Problem

• zero-day attack
• intrusion detection system
• cybersecurity
• unknown vulnerabilities
• attack detection

Innovation

• Self-Attention
• Jensen-Shannon Divergence
• WGAN-GP
• Zero-Day Attack Detection
• Intrusion Detection System