CoLD: Collaborative Label Denoising Framework for Network Intrusion Detection

CoLD: Collaborative Label Denoising Framework for Network Intrusion Detection

Speakers: Shuo Yang

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=IwyBa23ktqM

Overview

CoLD (Collaborative Label Denoising) is a framework that addresses a fundamental but often overlooked problem in network intrusion detection: label noise in training data. The researchers demonstrate that mislabeled data in IDS datasets causes 15-50% performance degradation at 20-40% noise levels, leading to high false positive rates that burden security teams. Through causal analysis, they identify the root cause as local consistency -- a phenomenon where features from different traffic categories share similar distributions, amplifying the impact of mislabeled samples.

The framework consists of three components: feature reordering to optimize semantic relationships, local joint learning to disrupt local consistency and extract robust representations via self-supervised learning, and causal collaborative denoising to identify and isolate mislabeled samples using Gaussian mixture models and causal divergence analysis. CoLD significantly outperforms eight baseline methods across benchmark datasets and demonstrates 5-6% performance improvement in real-world enterprise APT detection deployments.

Background

▶ Watch: The label noise problem: 15-50% IDS performance drop (0:00)

Data-driven intrusion detection systems rely on labeled datasets for training, where the quality of labels directly determines model effectiveness. Label noise enters IDS datasets through multiple channels:

Human error and annotation mistakes during the manual labeling process are inevitable at scale. Dynamic network environments with evolving attack patterns make static labels outdated over time. Stealth attackers using encryption and techniques that blur the benign/malicious boundary create ambiguous ground truth. Advanced malware variants that mimic normal traffic patterns further complicate accurate labeling.

When models are trained on noisy labels, they learn spurious correlations rather than genuine attack patterns, generating false positives for benign activity and failing to detect critical threats. Existing approaches to this problem fall into two categories: robust training methods that modify loss functions or training strategies (but require unrealistic assumptions like prior knowledge of label reliability or access to clean validation data), and dataset purification methods that attempt to detect mislabeled instances (but struggle with local consistency in feature distributions).

The researchers use structural causal models to formalize the problem, identifying three pathways: the true causal path (causal features determining ground truth), the backdoor path (creating fake associations through confounding), and the shortcut path (where noise labels direct the model toward non-causal features).

Key Findings

▶ Watch: Structural causal model: three noise pathways identified (4:00)

Local consistency is the root cause of noise amplification in IDS. Using the Kolmogorov-Smirnov test, the researchers found that the top 20 features share similar distributions across approximately 80%+ of category combinations. Even the most important features (top 22) exhibit significant overlap across categories. This means the model cannot reliably distinguish between categories using individual features, making it highly susceptible to mislabeled samples that exploit these overlapping distributions.

Causal analysis reveals three noise pathways. The structural causal model identifies how noise labels corrupt learning: through backdoor paths that create fake associations between causal features and incorrect labels, and through shortcut paths where noise labels direct models toward non-causal features, distorting the true causal pathway.

CoLD outperforms eight baselines across all noise settings. Compared against IDS methods (ACID, CLID), robust learning methods (Decoupling, Co-Teaching, Co-Teaching+), and dataset purification methods (Fine, MC, MC variants), CoLD demonstrates superior robustness that increases as noise levels rise.

5-6% performance improvement in enterprise APT detection. When deployed as a plug-in module with FLASH (Word2Vec + GNN) and ARGUS (GNN + LSTM) threat detection systems on the OPTC dataset (enterprise network logs with real attack scenarios), CoLD consistently improved detection performance across all noise settings.

Epsilon-zero purification ensures strict data quality. The purification step retains samples only if all subsets are causally associated with the observed label, ensuring the final training set contains only high-confidence correctly-labeled samples.

Technical Deep Dive

▶ Watch: Feature reordering with MST and DFS for semantic optimization (8:00)

CoLD's three-component architecture addresses label noise systematically:

Component 1: Feature Reordering. The original feature set is transformed to maximize local correlations. First, a Pearson correlation matrix is computed across all features. A maximum spanning tree (MST) is constructed to maximize total correlation weights between connected features. A depth-first search (DFS) traversal then determines feature ordering, placing highly correlated features adjacent to each other. Random masking using a Bernoulli distribution creates perturbed feature vectors, increasing local feature diversity and disrupting local consistency.

Component 2: Local Joint Learning. Reordered features are divided into multiple subsets, each fed into a shared encoder. Two self-supervised losses are applied: local alignment loss (ensuring subset representations capture modality-specific semantics) and global reconstruction loss (ensuring overall semantic information is preserved). This learns discriminative representations from multiple perspectives without relying on potentially noisy labels, effectively breaking the backdoor path in the causal model.

Component 3: Causal Collaborative Denoising. A Gaussian Mixture Model (GMM) models the complex distribution of network traffic samples, handling class overlap. Representations are mapped to mixture components, and posterior probabilities are computed for cluster label assignments. A Causal Divergence Matrix (CDM) quantifies the probability of noise transfer between multiple subset predictions and observed labels, calculating average disagreement across all subsets. Cross-entropy loss bridges the gap between self-supervised cluster predictions and supervised observed labels. Data purification with epsilon = 0 retains only samples where all subsets agree with the observed label.

The datasets used include MLS 2022 (23 classes) and another dataset with similar class count, both highly imbalanced with Gini coefficients of 0.82 and 0.84. Two noise scenarios are evaluated: symmetric noise (uniform corruption across benign and malicious) and asymmetric noise (corruption exclusively within malicious classes, simulating adversarial label poisoning).

Demo / Proof of Concept

▶ Watch: Causal collaborative denoising with Gaussian mixture models (10:00)

The enterprise deployment validation used the OPTC dataset, which contains large-scale enterprise network logs with real-life attacker scenarios representing Advanced Persistent Threat (APT) activity. CoLD was integrated as a plug-in module with two existing provenance graph-based threat detection systems:

FLASH: Uses Word2Vec for embedding and GNN for provenance graph encoding.

ARGUS: Integrates GNN with LSTM for dynamic graph representation learning.

Both systems used XGBoost as the classifier for real-time processing. CoLD consistently improved performance across all noise settings, validating its effectiveness in real-world enterprise deployments with 5-6% performance improvement.

Defensive Implications

▶ Watch: Summary and four key contributions (14:00)

This research addresses a critical but often invisible problem in IDS deployment: the quality of training labels. For security operations teams, the implications are:

Audit your training data. Most organizations trust their IDS training labels without verification. This research demonstrates that even moderate label noise (20-40%) can cause 15-50% performance degradation. Security teams should implement label quality auditing as part of their IDS maintenance process.

Label noise is worse in adversarial scenarios. The asymmetric noise model, where corruption occurs exclusively within malicious classes, simulates an attacker deliberately poisoning IDS training data. This is a realistic threat model for organizations where adversaries may have the ability to influence traffic labeling through stealth techniques.

CoLD works as a plug-in. Rather than requiring a complete IDS replacement, CoLD can be integrated with existing detection systems (FLASH, ARGUS, or similar) as a data quality improvement module. This makes adoption practical for organizations with established IDS infrastructure.

Focus on feature distribution overlap. The finding that 80%+ of top features share similar distributions across attack categories explains why many IDS deployments suffer from high false positive rates. Organizations should evaluate whether their IDS features provide genuine discriminative power or merely reflect local consistency artifacts.

Key Takeaways

• Label noise in IDS training data causes 15-50% performance degradation at 20-40% noise levels, with increased false positives and missed detections
• Local consistency -- where 80%+ of top features share distributions across categories -- is the root cause of noise amplification in network traffic classification
• Causal analysis reveals three pathways through which noise labels corrupt learning: true causal, backdoor, and shortcut paths
• CoLD's three-component framework (feature reordering, local joint learning, causal collaborative denoising) outperforms eight baseline methods across all noise settings
• Enterprise deployment on the OPTC APT detection dataset shows 5-6% performance improvement as a plug-in module
• The framework works with both symmetric noise (random corruption) and asymmetric noise (adversarial label poisoning)

About the Speaker(s)

The paper was presented by a colleague of the authors, as the primary researchers were unable to attend. The research team is from the University of Hong Kong and UCL (University College London). The first author is Shuo Yang. The work focuses on label noise robustness in network intrusion detection, combining causal inference with self-supervised learning for data quality improvement.