Abstract

A zero-day attack is a very serious threat to network security because it is based upon a vulnerability that is currently not known and therefore cannot be taken into account by security systems. Based on this, a new deep learning model to detect these attacks in network traffic is proposed in this study. The model is based on CNN, BiLSTM, Multi-Head attention and transfer learning. The UNSW-NB15 database is used for testing this model. To test zero-day attacks correctly, one type of attack (Exploits) is not included in training and used only during testing. CNN is able to identify important patterns in the data, BiLSTM identifies temporal relationships, and the attention mechanism identifies the important features. Transfer learning helps the model to detect new types of attacks even without previous examples. This model is evaluated in comparison to other models including XGBoost, and to a similar model without transfer learning. Results show that the planned model performs better in terms of accuracy, detection rate, F1-score, and false alarm reduction.