Autoencoder-Based Network Intrusion Detection on Multiple Datasets

Autoencoders are deep learning algorithms that transform input into a different representation based on the model on which they are trained. What makes them different from the rest of the deep learning algorithms is the fact that in the training phase, they learn in an unsupervised manner, using only one class of data that they need to recognize later on. This feature can be a promising path in the design of a cyberattack intrusion detection system due to the fact that it can learn about normal behavior and classify any abnormality as an attack, making it suitable for detecting even zero-day attacks. However, one notable gap in the current research is the lack of comprehensive analysis using multiple data sources. The goal of this paper is to investigate the possibilities of autoencoder applications in network intrusion detection systems and evaluate the results against multiple datasets. We will design and implement three autoencoders with different parameter sets and train them on three different reference datasets. We will present the performance of each of these nine combinations and demonstrate how distinct datasets can yield entirely different conclusions for the same autoencoder for the same type of cyberattack due to various feature extraction strategies.