Autoencoders: A Low Cost Anomaly Detection Method for Computer Network Data Streams

Computer networks are vulnerable to cyber attacks that can affect the confidentiality, integrity and availability of mission critical data. Intrusion detection methods can be employed to detect these attacks in real-time. Anomaly detection offers the advantage of detecting unknown attacks in a semi-supervised fashion. This paper aims to answer the question if autoencoders, a type of semisupervised feedforward neural network, can provide a low cost anomaly detector method for computer network data streams.

Autoencoder methods were evaluated online with the KDD’99 and UNSW-NB15 data sets, demonstrating that running time and labeling cost are significantly reduced compared to traditional online classification techniques for similar detection performance.

Further research would consider the trade-off between single vs stacked networks, multi-label classification, concept drift detection and active learning.