Self-Organizing Map assisted Deep Autoencoding Gaussian Mixture Model for Intrusion Detection
This work addresses network security by enhancing intrusion detection accuracy, though it is incremental as it builds on existing DAGMM methods.
The paper tackles the problem of preserving input space topology in deep autoencoding Gaussian mixture models for network intrusion detection, achieving up to a 15.58% improvement in F1 score over state-of-the-art methods.
In the information age, a secure and stable network environment is essential and hence intrusion detection is critical for any networks. In this paper, we propose a self-organizing map assisted deep autoencoding Gaussian mixture model (SOMDAGMM) supplemented with well-preserved input space topology for more accurate network intrusion detection. The deep autoencoding Gaussian mixture model comprises a compression network and an estimation network which is able to perform unsupervised joint training. However, the code generated by the autoencoder is inept at preserving the topology of the input space, which is rooted in the bottleneck of the adopted deep structure. A self-organizing map has been introduced to construct SOMDAGMM for addressing this issue. The superiority of the proposed SOM-DAGMM is empirically demonstrated with extensive experiments conducted upon two datasets. Experimental results show that SOM-DAGMM outperforms state-of-the-art DAGMM on all tests, and achieves up to 15.58% improvement in F1 score and with better stability.