Autoencoder and Extreme Value Theory Based Unknown Intrusion Detection System

Controlling the events occurring in the network traffic and detecting malicious activities are of great importance for the security and sustainability of the system. For this reason, it is necessary to accurately detect different types of attacks that may occur in network traffic. On the other hand, it is very important from the security aspect to be able to distinguish the types of attacks that have not been seen before. In this paper, a two-step procedure is proposed that can both correctly classify known attack types and distinguish unknown attack types. In the first stage, incoming traffic is classified by supervised learning with an autoencoder. In the second stage, the reliability of this classification is checked with the help of the autoencoder and the Extreme Value Theorem (EVT). According to the reliability value, incoming traffic is classified as unknown class. The simulation results were obtained with the IDS 2017 data set, which is widely used in the literature.