Unsupervised learning approach for network intrusion detection system using autoencoders

• Published in: The Journal of supercomputing Vol. 75; no. 9; pp. 5597 - 5621
• Main Authors: Choi, Hyunseung, Kim, Mintae, Lee, Gyubok, Kim, Wooju
• Format: Journal Article
• Language: English
• Published: New York Springer US 01-09-2019; Springer Nature B.V
• Subjects: Algorithms; Anomalies; Cluster analysis; Communications traffic; Compilers; Computer Science; Data acquisition; Interpreters; Intrusion detection systems; Machine learning; Model accuracy; Network analysis; Processor Architectures; Programming Languages; Security management; Service introduction; Support systems; Unsupervised learning; NSL-KDD; Intrusion detection system; Autoencoder; Unsupervised learning; Anomaly detection
• ISSN: 0920-8542; 1573-0484
• DOI: 10.1007/s11227-019-02805-w

Network intrusion detection systems are useful tools that support system administrators in detecting various types of intrusions and play an important role in monitoring and analyzing network traffic. In particular, anomaly detection-based network intrusion detection systems are widely used and are mainly implemented in two ways: (1) a supervised learning approach trained using labeled data and (2) an unsupervised learning approach trained using unlabeled data. Most studies related to intrusion detection systems focus on supervised learning. However, the process of acquiring labeled data is expensive, requiring manual labeling by network experts. Therefore, it is worthwhile investigating the development of unsupervised learning approaches for intrusion detection systems. In this study, we developed a network intrusion detection system using an unsupervised learning algorithm autoencoder and verified its performance. As our results show, our model achieved an accuracy of 91.70%, which outperforms previous studies that achieved 80% accuracy using cluster analysis algorithms. Our results provide a practical guideline for developing network intrusion detection systems based on autoencoders and significantly contribute to the exploration of unsupervised learning techniques for various network intrusion detection systems.