Anomaly Based Network Intrusion Detection Using Autoencoders

Abstract

Network intrusion detection helps to prevent cyber-attacks on the current networks. Classical signature-based approaches cannot identify new attacks, which drives application of the anomaly-based ones. This paper suggests a composite framework of anomaly detection, which combines autoencoder, latent-space Isolation Forest, and weighted ensemble, which is specifically implemented to the NSL-KDD dataset. The autoencoder is only trained on mainstream traffic to be able to grasp the distribution of benign traffic, and anomaly scoring is used by calculating reconstruction errors. Latent-space representations are additionally analyzed using an Isolation Forest to increase the distinction between aberrant designs. The best weighting program is adjusted according to a validation set and the ultimate threshold is selected based on Youdens J statistic to adjust the false positive and true positive. As the experimental findings demonstrate, the proposed ensemble method provides the accuracy of 95.53 percent, the macro F1-score (0.9551), and the ROC-AUC (0.9867), which is remarkably better in detecting the objects than the solo-model autoencoder methodologies. The paper verifies that deep representation learning coupled with ensemble-based scoring is effective in terms of network intrusion detection.