Network Anomaly Detection with Deep Learning

Abstract

Along with the developing new technologies, security breaches have become one of the major concerns in the cyber world. In order to provide safety, anti-viruses, firewalls, intrusion detection/prevention systems and many others are used together. However, these tools provide protection in the boundaries of their pre-defined rules and databases, thus being as secure as their updated profiles and while these tools exhibit high performance against conventional attacks, the protected systems become weak against the new and complex type of attacks. In order to prevent new kinds of attacks, for example, the zero-day attacks, it is necessary to constantly monitor the flow of the events and make inferences to detect abnormal behavior. At this point, to provide robust solutions, the deep learning models that are capable of making high-performance inferences from the natural flow of data are frequently used. In this study, the performance of a deep learning model, including automatic feature extraction and autoencoders, is measured against normal and anomalous behavior. In terms of the comparability of the measurements, the NSL-KDD dataset is used and the results are improved compared to the literature.