A Robust PCA Feature Selection To Assist Deep Clustering Autoencoder-Based Network Anomaly Detection

Abstract

This paper presents a novel method to enhance the performance of Clustering-based Autoencoder models for network anomaly detection. Previous studies have developed regularized variants of Autoencoders to learn the latent representation of normal data in a semi-supervised manner, including Shrink Autoencoder, Dirac Delta Variational Autoencoder and Clusteringbased Autoencoder. However, there are concerns regarding the feature selection of the original data, which stronger support Autoencoders models exploring more intrinsic, meaningful and latent features at bottleneck. The method proposed involves combining Principal Component Analysis and Clustering-based Autoencoder. Specifically, PCA is used for the selection of new data representation space, aiming to better assist CAE in learning the latent, prominent features of normal data, which addresses the aforementioned concerns. The proposed method is evaluated using the standard benchmark NSL-KDD data set and four scenarios of the CTU13 datasets. The promising experimental results confirm the improvements offered by the proposed approach, in comparison to existing methods. Therefore, it suggests a strong potential application within modern network anomaly detection systems.

Deep Nested Clustering Auto-Encoder for Anomaly-Based Network Intrusion Detection

“…A novel DL approach is introduced to build anomaly-based IDSs in a semi-supervised manner. The proposed model aims to overcome the limitations of recently proposed methods [16], [17], [14] that effectively learn profiles of normal network data. In addition, the proposed model will provide a more optimal arrangement for normal network data points in the feature space to increase the efficiency of anomaly detection.…”

“…We use these results as a baseline. Secondly, we reconstruct the experiments using Clustering-based DAE (DCAE) [16] and stacked PCA and DCAE model (PCADCAE) [17] as state-of-the-art methods for learning the latent space of the normal network data before training the OCC classifiers. Finally, we train the proposed model DNCAE to learn the expressive, compact latent space and then fit it into the aforementioned OCC classifiers in the same experimental conditions.…”

“…PROPOSED METHODOLOGY Our goal is to build a powerful, informative latent representation space from only normal network data, which facilitates the performance of conventional anomaly detection techniques. The proposed model aims to overcome the limitations pointed out in recent previous works [16], [14], [17]. In order to do that, we designed a model capable of learning the compact, tight representation from normal network data, in which the arrangement of data points is as optimal as possible.…”