Autoencoder-based Unsupervised Intrusion Detection using Multi-Scale Convolutional Recurrent Networks

Abstract

The massive growth of network traffic data leads to a large volume of datasets. Labeling these datasets for identifying intrusion attacks is very laborious and error-prone. Furthermore, network traffic data have complex time-varying non-linear relationships. The existing state-of-the-art intrusion detection solutions use a combination of various supervised approaches along with fused features subsets based on correlations in traffic data. These solutions often require high computational cost, manual support in finetuning intrusion detection models, and labeling of data that limit real-time processing of network traffic. Unsupervised solutions do reduce computational complexities and manual support for labeling data but current unsupervised solutions do not consider spatio-temporal correlations in traffic data. To address this, we propose a unified Autoencoder based on combining multi-scale convolutional neural network and long short-term memory (MSCNN-LSTM-AE) for anomaly detection in network traffic. The model first employs Multiscale Convolutional Neural Network Autoencoder (MSCNN-AE) to analyze the spatial features of the dataset, and then latent space features learned from MSCNN-AE employs Long Short-Term Memory (LSTM) based Autoencoder Network to process the temporal features. Our model further employs two Isolation Forest algorithms as error correction mechanisms to detect false positives and false negatives to improve detection accuracy. We evaluated our model NSL-KDD, UNSW-NB15, and CICDDoS2019 dataset and showed our proposed method significantly outperforms the conventional unsupervised methods and other existing studies on the dataset.

FPGA/AI-Powered Architecture for Anomaly Network Intrusion Detection Systems

“…The Table 14 shows the anomaly detection ability of some studies tested on the UNSW-NB15 dataset. In particular, the 2-Stage Ensemble [18], the LogAE-XGBoost [48], and MSCNN-LSTM-AE [49] achieve higher accuracy results (91.27%, 95.11%, and 89%, respectively) than our ANC with the UNSW-NB15 dataset (87.49%). However, our system outperforms the rest.…”

“…Regarding the precision parameters, our system is better than studies in [50] only. In contrast, the ANC with UNSW-NB15 technique on the FPGA-based ADNN system achieves a higher recall value than work in [18,29,49,50]. Finally, for the CIC-IDS2017 dataset, most of the machine learning and deep learning algorithms achieve impressive results, as shown in Table 15.…”

CBF-IDS: Addressing Class Imbalance Using CNN-BiLSTM with Focal Loss in Network Intrusion Detection System

“…Consequently, there arises a necessity to convert these one-dimensional features into a two-dimensional matrix. By leveraging 2D CNN, we can capture relationships and spatial dependencies that span across diverse feature combinations [40]. After completing the aforementioned data preprocessing steps, the NSL-KDD dataset consists of 121 numerical features that are reshaped into an 11 × 11 × 1 matrix.…”

An Improved Deep Learning Model for DDoS Detection Based on Hybrid Stacked Autoencoder and Checkpoint Network

“…In addition, the model functioned most effectively when it split the data in a 70/30 train/test split ratio. Singh and Jang-Jaccard (2022) [18] created a hybrid autoencoder model dubbed MSCNN-LSTM-AE. This model found anomalies in network traffic by utilizing a combination of a multi-scale convolutional neural network (MSCNN) and LSTM.…”