Network Anomaly Detection With Stacked Sparse Shrink Variational Autoencoders and Unbalanced XGBoost
Jing Bi, Ziyue Guan, Haitao Yuan, Jinhong Yang, Jia Zhang
Abstract
Efficient and accurate identification of network anomalies is significant to network security systems. It is highly challenging to detect abnormal behaviors in the increasing network data accurately. Currently, classification methods based on feature extraction of autoencoders have been proven to be suitable for network anomaly detection. However, traditional detection models with autoencoders have unsatisfying detection accuracy in the face of massive network features. In addition, the hyperparameter optimization of their models cannot be effectively solved. In this work, based on the improvement of variational autoencoders, stacked sparse shrink variational autoencoders (S3VAEs) are designed. In addition, an <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">U</u> nbalanced <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">X</u> GBoost classifier based on <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</u> enetic simulated annealing particle swarm optimization (UXG) is proposed. Finally, the feature extractor of S3VAEs is combined with the UXG classifier, and the anomaly detection model is obtained. Experimental results based on four real-life data sets demonstrate that the proposed anomaly detection model achieves higher classification accuracy and F1 than several state-of-the-art algorithms.