Application of deep autoencoder as an one-class classifier for unsupervised network intrusion detection: a...

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• The internet's growth fuels cybercrime, necessitating advanced network security.
• Intrusion Detection Systems (IDS) are crucial, but supervised methods require extensive labeled data, which is difficult to obtain.
• Unsupervised deep learning, particularly autoencoders (AEs), shows potential for learning robust features from unlabeled network traffic.

Purpose of the Study:

• To comparatively evaluate different autoencoder (AE) variants for unsupervised, one-class intrusion detection.
• To address the gap in research regarding the efficacy of various AE architectures in intrusion detection.
• To provide insights into building effective unsupervised IDS using deep learning.

Main Methods:

• Evaluation of five AE variants: Stacked AE, Sparse AE, Denoising AE, Contractive AE, and Convolutional AE.
• Implementation of a unified network configuration and training scheme for fair comparison.
• Testing across benchmark datasets: NSL-KDD and UNSW-NB15.

Main Results:

• Demonstrated the potential of different AE variants as one-class classifiers for intrusion detection.
• Provided a comparative analysis of AE performance under consistent experimental conditions.
• Highlighted the feasibility of unsupervised deep learning for building effective IDS.

Conclusions:

• Autoencoder variants are effective for unsupervised intrusion detection, reducing reliance on labeled data.
• The study offers valuable insights for the network security community on leveraging deep learning for IDS.
• This research paves the way for more efficient and scalable network defense mechanisms.