Improving Network Intrusion Detection Using Autoencoder Feature Residuals

Abstract

Anomaly detection techniques are often used to identify abnormal network communications by performing comparisons to normal network behavior. Oftentimes, these anomalies prompt additional investigation to determine if the anomaly is an indicator of a network attack. In this work we use the residuals of autoencoders in order to improve the performance of classifiers identifying network attacks. Unlike most existing works, we utilize the residuals of each feature as opposed to a summary residual metric. We explore several strategies for using feature residuals and show their effectiveness at improving general classifier performance across multiple datasets and scenarios.