Abstract:With the rapid advancement in network technologies, the need for cybersecurity has gained increasing momentum in recent years. As a primary defense mechanism, an intrusion detection system (IDS) is expected to adapt and secure the computing infrastructures from the ever-changing sophisticated threat landscape. Many deep learning approaches have recently been proposed; however, these techniques face significant challenges in identifying all types of attacks, especially rare attacks due to network traffic imbalances and the lack of a sufficient number of abnormal traffic samples for model training. To overcome these shortcomings and improve detection performance, this paper presents an unsupervised deep learning approach for intrusion detection. Unlike the existing IDS model that extracts features and trains a classifier in two separate stages, a single-stage IDS approach that integrates a one-dimensional convolutional autoencoder (1D CAE) and a one-class support vector machine (OCSVM) as a classifier into a joint optimization framework is introduced in this paper for the first time. Using only the normal traffic samples, the approach simultaneously optimizes the 1D CAE for compact feature representation and the OCSVM for classification by defining a unified objective function combining reconstruction error with classification error. Thus, the generated compact feature representation has not only reconstruction ability but also discriminative ability for classification. An in-depth ablation analysis validates the design decisions and provides further insight of the proposed approach. An extensive set of experiments on two benchmark intrusion datasets, NSL-KDD and UNSW-NB15, demonstrates the generalization ability of the proposed model for unseen attacks and confirms it as a competitive approach over the recent state-of-the-art intrusion detection baselines. Overall, the obtained results emphasize that the proposed approach has potential to serve as a baseline for building an effective IDS.

Evolutionary Convolutional Neural Network: an Application to Intrusion Detection

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

CBF-IDS: Addressing Class Imbalance Using CNN-BiLSTM with Focal Loss in Network Intrusion Detection System

Differential Evolution-Based Convolutional Neural Networks: An Automatic Architecture Design Method for Intrusion Detection in Industrial Control Systems

Evolving Deep Convolutional Neural Network for Intrusion Detection Based on NEAT.

Intrusion Detection System Using Convolutional Neural Network on UNSW NB15 Dataset

An Intrusion Detection System Using a Deep Neural Network with Gated Recurrent Units.

An Intrusion Detection Model Based on Feature Reduction and Convolutional Neural Networks

A Survey of CNN-Based Network Intrusion Detection

Enhanced Convolution Neural Network with Optimized Pooling and Hyperparameter Tuning for Network Intrusion Detection

Convolutional Neural Network for Intrusion Detection System In Cyber Physical Systems

Network Intrusion Detection CNN Model for Realistic Network Attacks Based on Network Traffic Classification

Intrusion Detection in Internet of Things using Convolutional Neural Networks

DL-IDS: Extracting Features Using CNN-LSTM Hybrid Network for Intrusion Detection System

Unsupervised deep learning approach for network intrusion detection combining convolutional autoencoder and one-class SVM

TL-CNN-IDS: transfer learning-based intrusion detection system using convolutional neural network

An intrusion detection system based on convolution neural network

Applying convolutional neural network for network intrusion detection

A Convolutional Neural Network with Hyperparameter Tuning for Packet Payload-Based Network Intrusion Detection

A Intrusion Detection Model Based on Convolutional Neural Network and Feature Selection

A Novel Wireless Network Intrusion Detection Method Based on Adaptive Synthetic Sampling and an Improved Convolutional Neural Network