Network intrusion detection for cyber security using unsupervised deep learning approaches

TLDR

Supervised learning and rule‑based IDS such as SNORT struggle to detect novel attack types. The study proposes a novel unsupervised deep‑learning approach for network intrusion detection. The method encodes traffic numerically, extracts features with Auto‑Encoder and Restricted Boltzmann Machine, reduces dimensionality, clusters the reduced data with k‑means on three features, and applies an Unsupervised Extreme Learning Machine for detection. On the KDD‑99 dataset, the approach achieves about 92 % detection accuracy, outperforming plain k‑means by 4.4 % and UELM by 2.95 %.

Abstract

In the paper, we demonstrate novel approach for network Intrusion Detection System (IDS) for cyber security using unsupervised Deep Learning (DL) techniques. Very often, the supervised learning and rules based approach like SNORT fetch problem to identify new type of attacks. In this implementation, the input samples are numerical encoded and applied un-supervised deep learning techniques called Auto Encoder (AE) and Restricted Boltzmann Machine (RBM) for feature extraction and dimensionality reduction. Then iterative k-means clustering is applied for clustering on lower dimension space with only 3 features. In addition, Unsupervised Extreme Learning Machine (UELM) is used for network intrusion detection in this implementation. We have experimented on KDD-99 dataset, the experimental results show around 91.86% and 92.12% detection accuracy using unsupervised deep learning technique AE and RBM with K-means respectively. The experimental results also demonstrate, the proposed approach shows around 4.4% and 2.95% improvement of detection accuracy using RBM with K-means against only K-mean clustering and Unsupervised Extreme Learning Machine (USELM) respectively.