Extreme Dimensionality Reduction for Network Attack Visualization with Autoencoders

Ferreira, Daniel; Vazquez, Felix Iglesias; Zseby, Tanja

doi:10.1109/ijcnn.2019.8852056

Cited by 14 publications

(7 citation statements)

References 45 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Different autoencoder architectures have been proposed to reduce the feature dimensionality in most popular network intrusion datasets. These methods were implemented and evaluated with the network traffic data in publicly available datasets which include KDD-Cup99 [49]- [56], NSL-KDD [49], [57]- [60], UNSW-NB15 [50], [59], [61] and CI-CIDS2017 [62]. Table I shows the autoencoder-based feature dimensionality reduction techniques in the literature.…”

Section: Related Workmentioning

confidence: 99%

Hybrid Deep Learning for Botnet Attack Detection in the Internet-of-Things Networks

Popoola

Adebisi

Hammoudeh

et al. 2021

IEEE Internet Things J.

144

View full text Add to dashboard Cite

Deep Learning (DL) is an efficient method for botnet attack detection. However, the volume of network traffic data and memory space required is usually large. It is, therefore, almost impossible to implement the DL method in memory-constrained IoT devices. In this paper, we reduce the feature dimensionality of large-scale IoT network traffic data using the encoding phase of Long Short-Term Memory Autoencoder (LAE). In order to classify network traffic samples correctly, we analyse the longterm interrelated changes in the low-dimensional feature set produced by LAE using deep Bidirectional Long Short-Term Memory (BLSTM). Extensive experiments are performed with the BoT-IoT dataset to validate the effectiveness of the proposed hybrid DL method. Results show that LAE significantly reduced the memory space required for large-scale network traffic data storage by 91.89%, and it outperformed state-of-the-art feature dimensionality reduction methods by 18.92 − 27.03%. Despite the significant reduction in feature size, the deep BLSTM model demonstrates robustness against model under-fitting and overfitting. It also achieves good generalisation ability in binary and multi-class classification scenarios.

show abstract

Section: Related Workmentioning

confidence: 99%

Hybrid Deep Learning for Botnet Attack Detection in the Internet-of-Things Networks

Popoola

Adebisi

Hammoudeh

et al. 2021

IEEE Internet Things J.

144

View full text Add to dashboard Cite

show abstract

“…A well-consolidated research stream has focused on the use of neural autoencoding models to lower the high dimensionality of original raw data in favour of compressed representations that exclude features prone to mis-classification [10]- [13], [28]. Stacked autoencoders are also considered in combination with traditional classifiers (e.g., SVM, K-NN, Gaussian Naive-Bayes) [29].…”

Section: Related Workmentioning

confidence: 99%

“…An autoencoder is an artificial neural network (NN) consisting of an encoder function mapping the input to a hidden code and a decoder, producing the reconstructed input learned by minimizing a loss function. As the hidden code commonly reduces the size of data, autoencoders are mostly used for saving the output of the encoder function for dimensionality reduction [9]- [13]. In any case, there are few studies that learn autoencoders, which go beyond the dimensionality reduction purpose, e.g., considering the output of the decoder function for data denoising [14] or the loss (residual error) for the anomaly detection [15]- [17].…”

Section: Introductionmentioning

confidence: 99%

Multi-Channel Deep Feature Learning for Intrusion Detection

et al. 2020

View full text Add to dashboard Cite

Networks had an increasing impact on modern life since network cybersecurity has become an important research field. Several machine learning techniques have been developed to build network intrusion detection systems for correctly detecting unforeseen cyber-attacks at the network-level. For example, deep artificial neural network architectures have recently achieved state-of-the-art results. In this paper a novel deep neural network architecture is defined, in order to learn flexible and effective intrusion detection models, by combining an unsupervised stage for multi-channel feature learning with a supervised one exploiting feature dependencies on cross channels. The aim is to investigate whether class-specific features of the network flows could be learned and added to the original ones in order to increase the model accuracy. In particular, in the unsupervised stage, two autoencoders are separately learned on normal and attack flows, respectively. As the top layer in the decoder of these autoencoders reconstructs samples in the same space as the input one, they could be used to define two new feature vectors allowing the representation of each network flow as a multi-channel sample. In the supervised stage, a multi-channel parametric convolution is adopted, in order to learn the effect of each channel on the others. In particular, as the samples belong to two different distributions (normal and attack flows), the samples labelled as normal should be more similar to the representation reconstructed with the normal autoencoder than that of the attack one, and viceversa. This expected dependency will be exploited to better disentangle the differences between normal and attack flows. The proposed neural network architecture leads to better predictive accuracy when compared to competitive intrusion detection architectures on three benchmark datasets.

show abstract

“…1 (c). Compared with the previous sequentially executed training process, SSAE achieves extraction of high-level features that are highly correlated with both the input data x and the labeled information y, by simultaneously optimizing θ AE and θ cl [35,[40][41][42][43].…”

Section: Semi-supervised Autoencodermentioning

confidence: 99%

“…Lastly, visualization of the monotonic health state transition in 2D space has ye be addressed by other research. Since 2D graphics provide the most obvious and readable space representation for the human eye, a 2D health feature space (HFS) can intuitively show diagnosis results [35].…”

Section: Introductionmentioning

confidence: 99%

A Semi-Supervised Autoencoder With an Auxiliary Task (SAAT) for Power Transformer Fault Diagnosis Using Dissolved Gas Analysis

Kim

et al. 2020

IEEE Access

View full text Add to dashboard Cite

This paper proposes a semi-supervised autoencoder with an auxiliary task (SAAT) to extract a health feature space for power transformer fault diagnosis using dissolved gas analysis (DGA). The health feature space generated by a semi-supervised autoencoder (SSAE) not only identifies normal and thermal/electrical fault types, but also presents the underlying characteristics of DGA. In the proposed approach, by adding an auxiliary task that detects normal and fault states in the loss function of SSAE, the health feature space additionally enables visualization of health degradation properties. The overall procedure of the new approach includes three key steps: 1) preprocessing DGA data, 2) extracting two health features via SAAT, and 3) visualizing the two health features in two-dimensional space. In this paper, we test the proposed approach using massive unlabeled/labeled Korea Electric Power Corporation (KEPCO) databases and IEC TC 10 databases. To demonstrate the effectiveness of the proposed approach, four comparative studies are conducted with these datasets; the studies examined: 1) the effectiveness of an auxiliary detection task, 2) the effectiveness of the visualization method, 3) conventional fault diagnosis methods, and 4) the state-of-the-art, semi-supervised deep learning algorithms. By examining several evaluation metrics, these comparative studies confirm that the proposed approach outperforms SSAE without the auxiliary task, existing methods, and state-of-the-art deep learning algorithms, in terms of defining health degradation performance. We expect that the proposed SAAT-based health feature space approach will be widely applicable to intuitively monitor the health state of power transformers in the real world.

show abstract

Extreme Dimensionality Reduction for Network Attack Visualization with Autoencoders

Cited by 14 publications

References 45 publications

Hybrid Deep Learning for Botnet Attack Detection in the Internet-of-Things Networks

Hybrid Deep Learning for Botnet Attack Detection in the Internet-of-Things Networks

Multi-Channel Deep Feature Learning for Intrusion Detection

A Semi-Supervised Autoencoder With an Auxiliary Task (SAAT) for Power Transformer Fault Diagnosis Using Dissolved Gas Analysis

Contact Info

Product

Resources

About