Enhancing network security using unsupervised learning approach to combat zero-day attack

Abstract

Machine learning (ML) and advanced neural network methodologies like deep learning (DL) techniques have been increasingly utilized in developing intrusion detection systems (IDS). However, the growing quantity and diversity of cyber-attacks pose a significant challenge for IDS solutions reliant on historical attack signatures. This highlights the industry's need for resilient IDSs that can identify zero-day attacks. Current studies focusing on outlier-based zero-day detection are hindered by elevated false-negative rates, thereby constraining their practical efficacy. This paper suggests utilizing an autoencoder (AE) approach for zero-day attack detection, aiming to achieve high recall while minimizing false negatives. Evaluation is conducted using well-established IDS datasets, CICIDS2017 and CSECICIDS2018. The model's efficacy is demonstrated by contrasting its performance with that of a one-class support vector machine (OCSVM). The research underscores the OCSVM's capability in distinguishing zero-day attacks from normal behavior. Leveraging the encoding-decoding capabilities of AEs, the proposed model exhibits promising results in detecting complex zero-day attacks, achieving accuracies ranging from 93% to 99% across datasets. Finally, the paper discusses the balance between recall and fallout, offering valuable insights into model performance.