Abstract:With the rapid advancement in network technologies, the need for cybersecurity has gained increasing momentum in recent years. As a primary defense mechanism, an intrusion detection system (IDS) is expected to adapt and secure the computing infrastructures from the ever-changing sophisticated threat landscape. Many deep learning approaches have recently been proposed; however, these techniques face significant challenges in identifying all types of attacks, especially rare attacks due to network traffic imbalances and the lack of a sufficient number of abnormal traffic samples for model training. To overcome these shortcomings and improve detection performance, this paper presents an unsupervised deep learning approach for intrusion detection. Unlike the existing IDS model that extracts features and trains a classifier in two separate stages, a single-stage IDS approach that integrates a one-dimensional convolutional autoencoder (1D CAE) and a one-class support vector machine (OCSVM) as a classifier into a joint optimization framework is introduced in this paper for the first time. Using only the normal traffic samples, the approach simultaneously optimizes the 1D CAE for compact feature representation and the OCSVM for classification by defining a unified objective function combining reconstruction error with classification error. Thus, the generated compact feature representation has not only reconstruction ability but also discriminative ability for classification. An in-depth ablation analysis validates the design decisions and provides further insight of the proposed approach. An extensive set of experiments on two benchmark intrusion datasets, NSL-KDD and UNSW-NB15, demonstrates the generalization ability of the proposed model for unseen attacks and confirms it as a competitive approach over the recent state-of-the-art intrusion detection baselines. Overall, the obtained results emphasize that the proposed approach has potential to serve as a baseline for building an effective IDS.

Intrusion detection using PCASOM neural networks

Application of Supervised SOM Neural Network in Intrusion Detection

Multi-agent based hybrid Intrusion detection system

Supervised Pca Neural Networks For Anomaly And Misuse Detection

A Hierarchical Intrusion Detection Model Based on the PCA Neural Networks

An adaptive network intrusion detection method based on PCA and support vector machines

A hybrid neural network approach to the classification of novel attacks for intrusion detection

Intrusion Detection Classifier Based On Self-Organizing Ant Colony Networks Clustering

Hybrid Intrusion Detection Method Based On K-Means And Cnn For Smart Home

Intrusion detection based on dynamic self-organizing map neural network clustering

Clustering based on Self-Organizing Ant Colony Networks with Application to Intrusion Detection

The abnormal traffic detection scheme based on PCA and SSH

An Intrusion Detection System Model Based on Self-Organizing Map

Research on Intrusion Detection Based on an Improved SOM Neural Network

Implement an Intrusion Detection System Utilizing Machine Learning and Principal Component Analysis

Network Anomaly Detection Based on DSOM and ACO Clustering

A Novel Intrusion Detection Method Based on Principle Component Analysis in Computer Security

Intrusion detection algorithm based on improved principal component analysis

Network Intrusion Detection Based on Extreme Learning Machine and Principal Component Analysis

Intrusion detection in wireless sensor network using enhanced empirical based component analysis

Unsupervised deep learning approach for network intrusion detection combining convolutional autoencoder and one-class SVM