Anomaly-Based Intrusion Detection From Network Flow Features Using Variational Autoencoder
Top Cited Papers
Open Access
- 10 June 2020
- journal article
- research article
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Access
- Vol. 8, 108346-108358
- https://doi.org/10.1109/access.2020.3001350
Abstract
The rapid increase in network traffic has recently led to the importance of flow-based intrusion detection systems processing a small amount of traffic data. Furthermore, anomaly-based methods, which can identify unknown attacks are also integrated into these systems. In this study, the focus is concentrated on the detection of anomalous network traffic (or intrusions) from flow-based data using unsupervised deep learning methods with semi-supervised learning approach. More specifically, Autoencoder and Variational Autoencoder methods were employed to identify unknown attacks using flow features. In the experiments carried out, the flow-based features extracted out of network traffic data, including typical and different types of attacks, were used. The Receiver Operating Characteristics (ROC) and the area under ROC curve, resulting from these methods were calculated and compared with One-Class Support Vector Machine. The ROC curves were examined in detail to analyze the performance of the methods in various threshold values. The experimental results show that Variational Autoencoder performs, for the most part, better than Autoencoder and One-Class Support Vector Machine.Keywords
Funding Information
- Scientific and Technological Research Council of Turkey (TUBITAK) through the 2211/C Ph.D. Scholarship Programme for Priority Areas
This publication has 56 references indexed in Scilit:
- Botnet detection based on traffic behavior analysis and flow intervalsComputers & Security, 2013
- ADMIRE: Anomaly detection method using entropy-based PCA with three-step sketchesComputer Communications, 2013
- Intrusion detection system: A comprehensive reviewJournal of Network and Computer Applications, 2013
- LIBSVMACM Transactions on Intelligent Systems and Technology, 2011
- Introduction to Semi-Supervised LearningSynthesis Lectures on Artificial Intelligence and Machine Learning, 2009
- Critical study of neural networks in detecting intrusionsComputers & Security, 2008
- Estimating the Support of a High-Dimensional DistributionNeural Computation, 2001
- Feature normalization and likelihood-based similarity measures for image retrievalPattern Recognition Letters, 2001
- Testing Intrusion detection systemsACM Transactions on Information and System Security, 2000
- Auto-association by multilayer perceptrons and singular value decompositionBiological Cybernetics, 1988