Abstract:With the rapid advancement in network technologies, the need for cybersecurity has gained increasing momentum in recent years. As a primary defense mechanism, an intrusion detection system (IDS) is expected to adapt and secure the computing infrastructures from the ever-changing sophisticated threat landscape. Many deep learning approaches have recently been proposed; however, these techniques face significant challenges in identifying all types of attacks, especially rare attacks due to network traffic imbalances and the lack of a sufficient number of abnormal traffic samples for model training. To overcome these shortcomings and improve detection performance, this paper presents an unsupervised deep learning approach for intrusion detection. Unlike the existing IDS model that extracts features and trains a classifier in two separate stages, a single-stage IDS approach that integrates a one-dimensional convolutional autoencoder (1D CAE) and a one-class support vector machine (OCSVM) as a classifier into a joint optimization framework is introduced in this paper for the first time. Using only the normal traffic samples, the approach simultaneously optimizes the 1D CAE for compact feature representation and the OCSVM for classification by defining a unified objective function combining reconstruction error with classification error. Thus, the generated compact feature representation has not only reconstruction ability but also discriminative ability for classification. An in-depth ablation analysis validates the design decisions and provides further insight of the proposed approach. An extensive set of experiments on two benchmark intrusion datasets, NSL-KDD and UNSW-NB15, demonstrates the generalization ability of the proposed model for unseen attacks and confirms it as a competitive approach over the recent state-of-the-art intrusion detection baselines. Overall, the obtained results emphasize that the proposed approach has potential to serve as a baseline for building an effective IDS.

Intrusion Detection System Based on One-Class Support Vector Machine and Gaussian Mixture Model

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

Distributed Online One-Class Support Vector Machine for Anomaly Detection over Networks

A Hybrid Algorithm Incorporating Vector Quantization and One-Class Support Vector Machine for Industrial Anomaly Detection

Unsupervised deep learning approach for network intrusion detection combining convolutional autoencoder and one-class SVM

Real-time intrusion detection system based on one-class SVM

Multilayer Intrusion Detection System Based on Semi-supervised Clustering

An Intrusion Detection Method Based on Stacked Sparse Autoencoder and Improved Gaussian Mixture Model

A HMM-based Method for Anomaly Detection

A Model Based on Hybrid Support Vector Machine and Self-Organizing Map for Anomaly Detection

Anomaly Intrusion Detection Using One Class Svm

Building an Efficient Intrusion Detection System Based on Feature Selection and Ensemble Classifier

Self-Organizing Map assisted Deep Autoencoding Gaussian Mixture Model for Intrusion Detection

An Efficient Network Intrusion Detection System Based on Feature Selection and Ensemble Classifier.

Semi-supervised Machine Learning Framework for Network Intrusion Detection

A Novel Framework For Anomaly Detection Based On Hybrid Hmm-Svm Model

An Incremental Majority Voting Approach for Intrusion Detection System Based on Machine Learning

Ad Hoc-Based Feature Selection and Support Vector Machine Classifier for Intrusion Detection

Intrusion detection algorithm of industrial control network based on improved one-class support vector machine

Intrusion Detection Model Based on Non-Symmetric Convolution Auto-Encode and Support Vector Machine

Abnormal Intrusion Detection System Based on Support Vector Machines