A Protocol-based Intrusion Detection System using Dual Autoencoders

This paper proposes a dual Autoencoder-based Intrusion Detection System (duAE-IDS) for the ever-changing network attacks. duAE-IDS is a protocol-based IDS, which divides traffic by its application-layer protocol. duAE-IDS determines the traffic's abnormality by considering both the criteria and the application-layer protocol. The criteria are obtained by training our neural network model (duAE model) with traffic containing only one type of application-layer protocol. duAE-IDS represents each traffic flow with 67 features with eight new features for TCP traffic to improve detection accuracy. duAE-Idsuses two sparse autoencoders and one 1D CNN to extract features from traffic for every application-layer protocol. We conduct several experiments to prove the abilities and flexibilities of duAE-IDS. We prove that duAE-Idstrained with the known datasets can reach an F1-score of 0.87 for detecting attack traffic in an unknown network. We can run duAE-Idsin any network without pre-collecting the traffic of the network.