Conditional Variational Autoencoder for Prediction and Feature Recovery Applied to Intrusion Detection in IoT

Abstract

The purpose of a Network Intrusion Detection System is to detect intrusive, malicious activities or policy violations in a host or host’s network. In current networks, such systems are becoming more important as the number and variety of attacks increase along with the volume and sensitiveness of the information exchanged. This is of particular interest to Internet of Things networks, where an intrusion detection system will be critical as its economic importance continues to grow, making it the focus of future intrusion attacks. In this work, we propose a new network intrusion detection method that is appropriate for an Internet of Things network. The proposed method is based on a conditional variational autoencoder with a specific architecture that integrates the intrusion labels inside the decoder layers. The proposed method is less complex than other unsupervised methods based on a variational autoencoder and it provides better classification results than other familiar classifiers. More important, the method can perform feature reconstruction, that is, it is able to recover missing features from incomplete training datasets. We demonstrate that the reconstruction accuracy is very high, even for categorical features with a high number of distinct values. This work is unique in the network intrusion detection field, presenting the first application of a conditional variational autoencoder and providing the first algorithm to perform feature recovery.

Network Intrusion Detection Based on Supervised Adversarial Variational Auto-Encoder With Regularization

“…In [20], the authors proposed an unsupervised network intrusion detection method based on a conditional variational auto-encoder, called ID-CVAE. This method has a specific architecture that integrates intrusion tags only inside the decoder layer.…”

“…In addition, in order to demonstrate the superiority of the proposed SAVAER-DNN, the performance of SAVAER-DNN is compared with other state-of-the-art intrusion detection models reported in the intrusion detection literature, including S-NDAE (stacked nonsymmetric deep auto-encoders) [7], SCDNN (spectral clustering and deep neural network) [19], ID-CVAE (a unsupervised network intrusion detection method based on a conditional variational auto-encoder) [20], RNN-IDS (recurrent neural network) [21], ResNet50 [22], GoogLeNe [22], LSTM 4 [24], GRU 3 [24], CFBLS (BLS with cascades of mapped features) [24], SHIA (scale-hybrid-IDS-AlertNet) [25], Gaussian-Bernoulli RBM [51], Random tree+NBTree [52], TSE-IDS (Two-Stage Classifier Ensemble for IDS) [53], EM Clustering [16], DT (decision tree) [16], TSDL (two-stage deep learning model) [23], CASCADE-ANN (a multiclass cascade of artificial neural network) [54] and AODE (average one dependence estimator algorithm) [55]. To be fair, only detection models using the same test dataset are selected.…”

The Use of Ensemble Models for Multiple Class and Binary Class Classification for Improving Intrusion Detection Systems

“…This implies that mostly all conventional IDS typically achieve poor performance. However, for an anomaly network-based IDS (A-NIDS), the authors in [17,18] proposed a primal dependable hybrid approach that incorporates the Adaboost meta-algorithm and artificial bee colony (ABC). This is intended to achieve optimal detection rate (DR) at a minimized false positive rate (FPR) [19].…”

The Optimally Designed Variational Autoencoder Networks for Clustering and Recovery of Incomplete Multimedia Data

“…The variational autoencoder, which is a new method for nonlinear dimensionality reduction, is a great case of combining probability plots with deep learning [34,35]. Consider a dataset X={}x1,x2,…,xN which consists of N independent and identically distributed samples of continuous or discrete variables x .…”