Using Autoencoder Feature Residuals to Improve Network Intrusion Detection

Lewandowski, Brian

Etd

Using Autoencoder Feature Residuals to Improve Network Intrusion Detection

Public Deposited

Network intrusion detection is a constantly evolving field with researchers and practitioners constantly working to keep up with novel attacks and growing amounts of network data. Traditionally, signature-based techniques and deep packet inspection have been employed, however, the volume of data and complexity of network attacks has made these techniques overbearing and susceptible to zero-day attacks. For this reason, there has been a shift in focus to explore the power of deep learning anomaly-based methods to perform network intrusion detection. In this dissertation we develop and explore several deep learning techniques and their application to performing anomaly-based network intrusion detection. Central to the work is an exploration of the development of unique feature sets using autoencoder feature residuals which have traditionally been overlooked in favor of aggregate residuals. We show that using feature sets generated using autoencoder feature residuals provide an improvement in downstream classifier performance compared to an original feature set for network intrusion detection. In doing so, we find that these overlooked byproducts of anomaly-based methods can be used as a drop-in replacement for an original feature set, meeting or exceeding its performance.

Creator