[Paper Review] AutoIDS: Auto-encoder Based Method for Intrusion Detection System

M. Gharib, Bahram Mohammadi+2 more|arXiv (Cornell University)|Nov 8, 2019

Network Security and Intrusion DetectionComputer Science50 references35 citations

TL;DR

AutoIDS uses a cascade of two auto-encoders (a sparse AE and a regular AE) trained on normal traffic to semi-supervisedly detect intrusions, achieving 90.17% accuracy on NSL-KDD with reduced computation.

ABSTRACT

Intrusion Detection System (IDS) is one of the most effective solutions for providing primary security services. IDSs are generally working based on attack signatures or by detecting anomalies. In this paper, we have presented AutoIDS, a novel yet efficient solution for IDS, based on a semi-supervised machine learning technique. AutoIDS can distinguish abnormal packet flows from normal ones by taking advantage of cascading two efficient detectors. These detectors are two encoder-decoder neural networks that are forced to provide a compressed and a sparse representation from the normal flows. In the test phase, failing these neural networks on providing compressed or sparse representation from an incoming packet flow, means such flow does not comply with the normal traffic and thus it is considered as an intrusion. For lowering the computational cost along with preserving the accuracy, a large number of flows are just processed by the first detector. In fact, the second detector is only used for difficult samples which the first detector is not confident about them. We have evaluated AutoIDS on the NSL-KDD benchmark as a widely-used and well-known dataset. The accuracy of AutoIDS is 90.17\% showing its superiority compared to the other state-of-the-art methods.

Motivation & Objective

• Motivate intrusion detection with anomaly detection instead of sole reliance on signatures.
• Develop a semi-supervised approach that learns from normal traffic only.
• Increase detection accuracy while reducing computational cost via a two-stage detector cascade.
• Demonstrate the method's generalization ability to unseen attacks on a standard benchmark.

Proposed method

• Propose a cascade of two detectors: a lightweight sparse auto-encoder (SAE) and a conventional auto-encoder (AE).
• Train both detectors exclusively on normal traffic to learn normal traffic representations.
• D1 (SAE) uses sparsity of latent representations with thresholds tau_min and tau_max to flag Normal, Anomaly, or Unknown samples, enabling fast early rejection.
• D2 (AE) uses reconstruction error with a threshold thr_AE (set via ROC analysis) to distinguish normal from anomalies on samples deemed Unknown by D1.
• Process large volumes of traffic via D1; pass only uncertain samples to D2 to balance accuracy and speed.
• Utilize two feature spaces (sparsity for D1 and reconstruction error for D2) to improve overall discrimination.

Experimental results

Research questions

• RQ1 Can AutoIDS accurately detect anomalies using only normal traffic for training (semi-supervised learning)?
• RQ2 Does cascading a sparse SAE and an AE improve detection accuracy and reduce average processing time per flow compared to using either detector alone?
• RQ3 How does AutoIDS perform on unseen/unknown attacks compared to state-of-the-art anomaly-based IDS methods?
• RQ4 What is the impact of threshold design (tau_min, tau_max, thr_AE) on detection performance and ROC characteristics?

Key findings

• AutoIDS achieves 90.17% accuracy on NSL-KDD when trained on KDDTrain+ and tested on KDDTest+, outperforming several state-of-the-art anomaly-based methods.
• AutoIDS generalizes better to unseen attacks than some supervised methods on NSL-KDD, demonstrated by comparisons where training focuses on normal data.
• Ablation studies show the two-detector cascade (D1 with sparsity, D2 with reconstruction error) yields higher accuracy, recall, and F-score than either detector alone.
• The cascade reduces runtime: average test time per incoming flow is 137 μs for AutoIDS (D1S→D2R), versus 195 μs for D2R and 202 μs for D1R.
• ROC-based threshold selection for thr_AE optimizes recall versus false positive trade-offs, contributing to robust anomaly detection.
• AutoIDS benefits from processing most samples in the fast D1 stage, while reserving the accurate but costlier D2 stage for hard cases.