Network Anomaly Detection using Threshold-based Sparse Autoencoder

Nowadays, cyber-attacks have been dramatically increased due to the rapid development of Internet-based services. The current network anomaly detection solutions such as Firewall, Snort, honeypots are useful, but they are insufficient to deal with zero-day attacks. At present, unsupervised deep learning technologies focus on increasing the performance of anomaly-based network attack detection in the recent research area. The normal and attack transactions can be distinguished by the threshold in the network anomaly detection using a sparse autoencoder. The threshold value estimation is not a non-trivial task. The key factor of the threshold value which draws a line between normal and attack highly depends on the accuracy of the network anomaly detection. In this paper, the network anomaly detection based on a sparse autoencoder with a percentile-based threshold selection algorithm is proposed. The results of the proposed system have been validated concerning the accuracy, precision, recall and false positive rate. As a result, the experimental results on UNSW-NB15 and NSL-KDD datasets have shown that the proposed system provides higher accuracy and outperforms the previous related works in recent years