Feature Extraction and Anomaly Detection Using Different Autoencoders for Modeling Intrusion Detection Systems

Maintaining network security by preventing attacks is essential for a network intrusion detection system. Machine learning techniques heavily depend on artificial feature extraction and have high complexity. However, autoencoders have shown promising results in reconstructing the input from reduced latent layer features, which can help perform additional tasks such as threat classification. This work analyzes the performance of different autoencoder models. It introduces CAAE-DNN: a feature extraction and classification intrusion detection model based on a convolutional auto-encoder, an attention mechanism, and a deep neural network (DNN). It has also been coupled with correlation-based feature selection to aid feature extraction. Owing to different data distributions, the model’s performance has been evaluated on two parts of the benchmark NSL-KDD dataset: on the data by doing a 90:10 train-test split and on the NSL-KDD Test+ data to check performance in a broader variety of attacks. After feature extraction, we noticed a smooth convergence of the epoch vs loss curve. Analysis with cost-sensitive learning has also been done because of the class imbalance in the dataset. They yield high classification metrics with an accuracy of 79.18% to build an efficient IDS. Finally, the ROC-AUC curves have also been plotted and analyzed to understand the performance with respect to each class of the model.