Abstract:DoS and DDoS attacks have been growing in size and number over the last decade and existing solutions to mitigate these attacks are largely inefficient. Compared to other types of malicious cyber attacks, DoS and DDoS attacks are particularly challenging to combat. Because of their ability to mask themselves as legitimate traffic, it has proven difficult to develop methods to detect these types of attacks on a packet or flow level. In this paper, we explore the potential of Variational Autoencoders to serve as a component within an intelligent security solution that differentiates between normal and malicious traffic. The motivation behind resorting to Variational Autoencoders is that unlike normal encoders that would code an input flow as a single point, they encode a flow as a distribution over the latent space which avoids overfitting. Intuitively, this allows a Variational Autoencoder to not only learn latent representations of seen input features, but to generalize in a way that allows for an interpretation of unseen flows and flow features with slight variations. Two methods based on the ability of Variational Autoencoders to learn latent representations from network traffic flows of both benign and malicious traffic, are proposed. The first method resorts to a classifier based on the latent encodings obtained from Variational Autoencoders learned from traffic traces. The second method is an anomaly detection method, where the Variational Autoencoder is used to learn the abstract feature representations of exclusively legitimate traffic. Anomalies are then filtered out by relying on the reconstruction loss of the Variational Autoencoder. In this sense, the construction loss of the autoencoder is fed as input to a classifier that outputs the class of the traffic including benign and malign, and eventually the attack type. Thus, the second approach operates with two separate training processes on two separate data sources: the first training involving only legitimate traffic, and the second training involving all traffic classes. This is different from the first approach which operates only a single training process on the whole traffic dataset. Thus, the autoencoder of the first approach aspires to learn a general feature representation of the flows while the autoencoder of the second approach aims to exclusively learn a representation of the benign traffic. The second approach is thus more susceptible to finding zero day attacks and discovering new attacks as anomalies. Both of the proposed methods have been thoroughly tested on two separate datasets with a similar feature space. The results show that both methods are promising, with the classifier-based method being slightly superior to the anomaly-based one.

A-CAVE: Network abnormal traffic detection algorithm based on variational autoencoder

Abnormal Network Traffic Detection Algorithm Based on Improved Convolutional Neural Network

Network Intrusion Detection Based on Supervised Adversarial Variational Auto-Encoder With Regularization

Improving the Classification Effectiveness of Intrusion Detection by Using Improved Conditional Variational AutoEncoder and Deep Neural Network

Toward Effective Intrusion Detection Using Log-Cosh Conditional Variational Autoencoder

A CVAE-Based Anomaly Detection Algorithm for Cyber Physical Attacks for Water Distribution Systems

DoS and DDoS mitigation using Variational Autoencoders

Conditional Variational Auto-Encoder and Extreme Value Theory Aided Two-Stage Learning Approach for Intelligent Fine-Grained Known/Unknown Intrusion Detection

Autoencoder-based Unsupervised Intrusion Detection using Multi-Scale Convolutional Recurrent Networks

A Semi-supervised Intrusion Detection Algorithm Based on Auto-encoder.

Industrial Control Malicious Traffic Anomaly Detection System Based on Deep Autoencoder

An Efficient Intrusion Detection Method Based on LightGBM and Autoencoder

ARCADE: Adversarially Regularized Convolutional Autoencoder for Network Anomaly Detection

Network intrusion detection based on conditional wasserstein variational autoencoder with generative adversarial network and one-dimensional convolutional neural networks

AAE-DSVDD: A one-class classification model for VPN traffic identification

Unsupervised deep learning approach for network intrusion detection combining convolutional autoencoder and one-class SVM

Network Anomaly Intrusion Detection Based on Deep Learning Approach

Learning from Attacks: Attacking Variational Autoencoder for Improving Image Classification

Semi-supervised intrusion detection system for in-vehicle networks based on variational autoencoder and adversarial reinforcement learning

Clustering-Based Deep Autoencoders for Network Anomaly Detection

A vector convolutional deep autonomous learning classifier for detection of cyber attacks