Optimizing Cyber Threat Detection Through Bottleneck Feature Extraction and Adaptive Boosting

Abstract

Objective: This study aims at optimization of cloud-based cyber threat detectors through the combination of autoencoder based feature compression with the AdaBoost classification algorithm. Its greatest aim is to properly classify different kinds of network attacks with the help of an efficient, broad-based model that uses the AWS Cloud Investigation Dataset as training. The idea is to be as accurate as possible but with minimal overfitting and dealing efficiently with multi-class cases in clouds. Methods: It consists of preprocessing of the dataset by one-hot encoding and feature normalization and feature extraction by a neural autoencoder that minimally compresses the input data into self-discovered latent representations. The features, which are then encoded, are entered in an AdaBoost classifier, which learns to discriminate between attack types. Accuracy, precision, recall, and F1 score across all classes are used to carry out evaluation. Findings: The hybrid autoencoder - AdaBoost model has a training accuracy of 92.14% and a testing accuracy of 89.55%; hence, it generalizes significantly. Normal, DDoS, and SQL injection attacks had high F1-scores of 0.98, 0.92, and 0.84, respectively. Nevertheless, less common attacks such as ransomware are detectable with less of an F1 score of 0.36. The convergence of the losses with 60 epochs also matched that effective learning took place without overfitting and was backed by persistent validation and training results. Novelty: This study is a combination of dimensionality reduction with an autoencoder and ensemble learning via AdaBoost to realize automatized and efficient classification of cloud network attacks. This pipeline differs from traditional methods in that it is highly accurate even in the case of an imbalanced situation. Moreover, the flexibility of the architecture could be applied in the wider usage of various cloud data sets. Keywords: Autoencoder, AdaBoost, Intrusion Detection, Feature Compression, Cloud Security