A Comparative Analysis of Single and Multi-View Deep Learning for Cybersecurity Anomaly Detection

This paper investigates the application of Deep Multi-View Learning (DMVL) to enhance the responsiveness of intrusion detection systems (IDS) in modern network environments, addressing the limitations of traditional IDS. The study used diverse datasets, including TON_IoT and UNSW-NB15, to evaluate anomaly detection capabilities across various host and network scenarios, with a particular emphasis on dataset diversity, single model diversity, and multi-view models diversity. The experiment found that multi-view models based on Autoencoder (AE) and Convolutional Neural Network (CNN) performed better in general than the corresponding single view model in detection anomaly. However, certain single view models outperformed multi-view models like Deep Generalized Canonical Correlation Analysis (DGCCA) in specific cases, This result showed that although multi-view methods generally had stronger comprehensive analysis capabilities, they were not the best choice in all scenarios. The effectiveness of multi-view methods depended largely on the specific model design and data characteristics. Further investigations comparing multi-view models, such as multi-view AE, CNN, and DGCCA, showed that the multi-view CNN model not only achieved the highest F1 score on the TON_IoT dataset, but also demonstrated strong robustness on the UNSW-NB15 dataset. These findings confirmed the effectiveness of multi-view methods in integrating complementary data in host and enterprise network scenarios based on network environments.