Learning Latent Distribution for Distinguishing Network Traffic in Intrusion Detection System

We develop a novel deep learning model, Multidistributed Variational AutoEncoder (MVAE), for the network intrusion detection. To make the traffic more distinguishable, MVAE introduces the label information of data samples into the Kullback-Leibler (KL) term of the loss function of Variational AutoEncoder (VAE). This label information allows MVAEs to force/partition network data samples into different classes with different regions in the latent feature space. As a result, the network traffic samples are more distinguishable in the new representation space (i.e., the latent feature space of MVAE), thereby improving the accuracy in detecting intrusions. To evaluate the efficiency of the proposed solution, we carry out intensive experiments on two popular network intrusion datasets, i.e., NSL-KDD and UNSWNB15 under four conventional classifiers including Gaussian Naive Bayes (GNB), Support Vector Machine (SVM), Decision Tree (DT), and Random Forest (RF). The experimental results demonstrate that our proposed approach can significantly improve the accuracy of intrusion detection algorithms up to 24.6% compared to the original one (using area under the curve metric).