Combination of a DAE-CNN and OC-SVDD for intrusion detection

Abstract

The extensive use of the internet has favoured the emergence of intrusion detection systems (IDSs). The detection of malicious events requires the learning of the patterns representing the attacks. Meanwhile, new threats appear regularly. Thus, it is crucial to develop IDSs that do not depend on malicious patterns. In this paper, we propose an IDS based on the deep auto-encoder (DAE) algorithm for feature extraction, and on the one-class support vector data description (OC-SVDD) method for intrusion detection. The DAE is trained exclusively on normal patterns and is expected to extract robust features representing the normal traffic. The OC-SVDD is trained based on these features, thus, during the test stage, malicious events are classified as outliers. We report experiments, on the well-known NSL-KDD dataset. The experimental results show an accuracy of about 97.73% and prove the potential of the proposed.