Abstract:With the rapid advancement in network technologies, the need for cybersecurity has gained increasing momentum in recent years. As a primary defense mechanism, an intrusion detection system (IDS) is expected to adapt and secure the computing infrastructures from the ever-changing sophisticated threat landscape. Many deep learning approaches have recently been proposed; however, these techniques face significant challenges in identifying all types of attacks, especially rare attacks due to network traffic imbalances and the lack of a sufficient number of abnormal traffic samples for model training. To overcome these shortcomings and improve detection performance, this paper presents an unsupervised deep learning approach for intrusion detection. Unlike the existing IDS model that extracts features and trains a classifier in two separate stages, a single-stage IDS approach that integrates a one-dimensional convolutional autoencoder (1D CAE) and a one-class support vector machine (OCSVM) as a classifier into a joint optimization framework is introduced in this paper for the first time. Using only the normal traffic samples, the approach simultaneously optimizes the 1D CAE for compact feature representation and the OCSVM for classification by defining a unified objective function combining reconstruction error with classification error. Thus, the generated compact feature representation has not only reconstruction ability but also discriminative ability for classification. An in-depth ablation analysis validates the design decisions and provides further insight of the proposed approach. An extensive set of experiments on two benchmark intrusion datasets, NSL-KDD and UNSW-NB15, demonstrates the generalization ability of the proposed model for unseen attacks and confirms it as a competitive approach over the recent state-of-the-art intrusion detection baselines. Overall, the obtained results emphasize that the proposed approach has potential to serve as a baseline for building an effective IDS.

A Semi-supervised Intrusion Detection Algorithm Based on Auto-encoder.

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

Representation Learning Via a Semi-Supervised Stacked Distance Autoencoder for Image Classification

Autoencoder-based Unsupervised Intrusion Detection using Multi-Scale Convolutional Recurrent Networks

Detecting In-vehicle Intrusion via Semi-supervised Learning-based Convolutional Adversarial Autoencoders

Few-Shot Network Intrusion Detection Using Discriminative Representation Learning with Supervised Autoencoder

An Efficient Intrusion Detection Method Based on LightGBM and Autoencoder

A Two-Stage Intrusion Detection Method Based on Light Gradient Boosting Machine and Autoencoder

A Lightweight Intelligent Network Intrusion Detection System Using One-Class Autoencoder and Ensemble Learning for IoT

Unsupervised deep learning approach for network intrusion detection combining convolutional autoencoder and one-class SVM

An intrusion detection system based on convolution neural network

Improving the Classification Effectiveness of Intrusion Detection by Using Improved Conditional Variational AutoEncoder and Deep Neural Network

Semi-supervised intrusion detection system for in-vehicle networks based on variational autoencoder and adversarial reinforcement learning

Semi-supervised tri-Adaboost algorithm for network intrusion detection

Network Intrusion Detection Method Based on Stacked Denoising Sparse Autoencoder and Extreme Learning Machine

Semi-supervised Noise-Resilient Anomaly Detection with Feature Autoencoder

Building Auto-Encoder Intrusion Detection System based on random forest feature selection

An Integrated Feature Extraction Based on Principal Components and Deep Auto Encoder with Extra Tree for Intrusion Detection Systems

A-CAVE: Network abnormal traffic detection algorithm based on variational autoencoder

Network Intrusion Detection Based on Supervised Adversarial Variational Auto-Encoder With Regularization

A network intrusion detection framework on sparse deep denoising auto-encoder for dimensionality reduction