Residual threshold validation enables lightweight intrusion detection with a two-stage BiGRU autoencoder

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Network intrusion detection systems (NIDS) face challenges with class imbalance and diverse attack patterns.
• Reconstruction residuals are common but suffer from unstable decision boundaries due to overlapping distributions and drift.
• Existing methods struggle with reproducibility and stability in real-world network environments.

Purpose of the Study:

• To propose a lightweight and reproducible intrusion detection framework.
• To address the limitations of single-threshold decision boundaries in NIDS.
• To enhance the accuracy and stability of network intrusion detection.

Main Methods:

• A two-stage BiGRU autoencoder is employed for learning reconstruction baselines and residual bounds.
• Residual Threshold Validation (RTV) framework with weak supervision and margin constraints is utilized.
• Top-k aggregation for unified intrusion scoring and a frozen threshold for reproducible evaluation.

Main Results:

• Achieved high F1-scores (0.9943 on KDDCUP99, 0.9898 on UNSW-NB15, 0.9795 on WSN-DS).
• Demonstrated low false-positive rates (0.10% on KDDCUP99, 2.06% on UNSW-NB15, 2.43% on WSN-DS).
• Model size is 186-194 KB, suitable for edge devices.

Conclusions:

• The proposed RTV framework offers high accuracy and reproducible decision boundaries for network intrusion detection.
• The lightweight design enables deployment on resource-constrained edge devices.
• Effectively handles class imbalance and diverse attack patterns in network traffic.