Practical autoencoder based anomaly detection by using vector reconstruction error

Cybersecurity

Research

Hasan Torabi¹  Seyedeh Leili Mirtaheri¹  Sergio Greco² 

[1] Department of Electrical and Computer Engineering, Faculty of Engineering, Kharazmi University, Tehran, Iran;Department of Informatics, Modeling, Electronics and System Engineering, University of Calabria, Arcavacata, Italy;

关键词: Cloud;    Practical;    Anomaly detection;    Autoencoder;    Reconstruction error;    Machine learning;   

DOI  :  10.1186/s42400-022-00134-9

 received in 2022-08-10, accepted in 2022-12-12,  发布年份 2022

来源: Springer

【 摘 要 】

Nowadays, cloud computing provides easy access to a set of variable and configurable computing resources based on user demand through the network. Cloud computing services are available through common internet protocols and network standards. In addition to the unique benefits of cloud computing, insecure communication and attacks on cloud networks cannot be ignored. There are several techniques for dealing with network attacks. To this end, network anomaly detection systems are widely used as an effective countermeasure against network anomalies. The anomaly-based approach generally learns normal traffic patterns in various ways and identifies patterns of anomalies. Network anomaly detection systems have gained much attention in intelligently monitoring network traffic using machine learning methods. This paper presents an efficient model based on autoencoders for anomaly detection in cloud computing networks. The autoencoder learns a basic representation of the normal data and its reconstruction with minimum error. Therefore, the reconstruction error is used as an anomaly or classification metric. In addition, to detecting anomaly data from normal data, the classification of anomaly types has also been investigated. We have proposed a new approach by examining an autoencoder’s anomaly detection method based on data reconstruction error. Unlike the existing autoencoder-based anomaly detection techniques that consider the reconstruction error of all input features as a single value, we assume that the reconstruction error is a vector. This enables our model to use the reconstruction error of every input feature as an anomaly or classification metric. We further propose a multi-class classification structure to classify the anomalies. We use the CIDDS-001 dataset as a commonly accepted dataset in the literature. Our evaluations show that the performance of the proposed method has improved considerably compared to the existing ones in terms of accuracy, recall, false-positive rate, and F1-score metrics.

【 授权许可】

CC BY   
© The Author(s) 2023

【 图 表 】

41116_2022_35_Article_IEq387.gif

Fig. 2

41116_2022_35_Article_IEq383.gif

41116_2022_35_Article_IEq379.gif

Fig. 2

41116_2022_35_Article_IEq375.gif

41116_2022_35_Article_IEq373.gif

Fig. 3

Fig. 2

41116_2022_35_Article_IEq369.gif

41116_2022_35_Article_IEq366.gif

41116_2022_35_Article_IEq363.gif

41116_2022_35_Article_IEq360.gif