Scholarlink

<p>Network intrusion detection under severe class imbalance and diverse attack patterns often relies on reconstruction residuals. However, overlapping residual distributions, sparse tails, and distribution drift make single-threshold decision boundaries unstable and hard to reproduce. This study proposes a lightweight and reproducible intrusion detection framework based on Residual Threshold Validation (RTV) with a two-stage BiGRU autoencoder. In Phase 1, the autoencoder is trained on normal samples to learn a stable reconstruction baseline and per-dimension residual bounds. In Phase 2, weak supervision from coarse binary labels and class-conditional margin constraints enlarges inter-class separation in the residual space. During inference, Top-k aggregation generates a unified intrusion score, and the threshold is determined on a validation split and frozen for test evaluation. Experiments on KDDCUP99, UNSW-NB15, and WSN-DS show F1-scores of 0.9943, 0.9898, and 0.9795, with false-positive rates of 0.10%, 2.06%, and 2.43%. These results demonstrate both high accuracy and reproducible decision boundaries. The model size is 186–194 KB, enabling deployment in resource-constrained scenarios such as edge devices.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Residual threshold validation enables lightweight intrusion detection with a two-stage BiGRU autoencoder

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年6月29日

查看全文
  • Hu Longcan,
  • Yao Wenbin,
  • Hou Yingying

摘要

Network intrusion detection under severe class imbalance and diverse attack patterns often relies on reconstruction residuals. However, overlapping residual distributions, sparse tails, and distribution drift make single-threshold decision boundaries unstable and hard to reproduce. This study proposes a lightweight and reproducible intrusion detection framework based on Residual Threshold Validation (RTV) with a two-stage BiGRU autoencoder. In Phase 1, the autoencoder is trained on normal samples to learn a stable reconstruction baseline and per-dimension residual bounds. In Phase 2, weak supervision from coarse binary labels and class-conditional margin constraints enlarges inter-class separation in the residual space. During inference, Top-k aggregation generates a unified intrusion score, and the threshold is determined on a validation split and frozen for test evaluation. Experiments on KDDCUP99, UNSW-NB15, and WSN-DS show F1-scores of 0.9943, 0.9898, and 0.9795, with false-positive rates of 0.10%, 2.06%, and 2.43%. These results demonstrate both high accuracy and reproducible decision boundaries. The model size is 186–194 KB, enabling deployment in resource-constrained scenarios such as edge devices.