Content from this work may be used under the terms of the Creative Commons Attribution 3.0 licence. Any further distribution
of this work must maintain attribution to the author(s) and the title of the work, journal citation and DOI.
Published under licence by IOP Publishing Ltd
AEMCME 2019
IOP Conf. Series: Materials Science and Engineering 563 (2019) 042007
IOP Publishing
doi:10.1088/1757-899X/563/4/042007
1
A Deep One-class Model for Network Anomaly Detection
Songlin Dai
1
Jubin Yan
2
Xiaoming Wang
2
Lin Zhang
2
1
State Grid SiChuan Electric Power Company, Chengdu,610000, China
2
Chengdu Chengdian Electric Power Engineering Design Co. Ltd, Chengdu 610000,
China
Lin Zhang, psplayer@126.com
Abstract. For traditional network anomaly detection system, the detection performance is
related to the selected features and training dataset. But traditional methods adopt handcraft
feature selection, which requires heavy human labour and relies on the experts’ knowledge and
experience. Besides, the collected dataset for training is not balanced, which makes the
prediction of the trained model tends to be biased to the majority class. In this paper, a one-
class network anomaly detection model based on the stacked autoencoders was proposed. We
use the stacked autoencoders to select the prominent features from the raw collected data, then
apply the one-class classification algorithm support vector data description to train a classifier
to identify the network traffic into normal data and anomalous data. The experimental results
demonstrate the promising results of our approach for network anomaly detection.
1. Introduction
Nowadays, the network has become an indispensable part of people's daily life. At the same time, the
exponential growth of cyber-attacks has become a major threat to network security. For the users of
the network, network security is an unavoidable problem, inadvertent negligence may lead to
irreparable damage to them. Therefore, the need for cyber defense has become more and more urgent.
There are two main network security technologies [1]: firewall and intrusion detection system.
Firewall is a passive security technology, which is designed to restrict and control the flow of traffic
between the out network and the protected network and monitors the unauthorized data transmission to
and from the protected network. Potential intruders can be blocked by installing a firewall at the edge
of the protected network boundaries. But there is a limitation for a firewall that firewall cannot protect
against insider attacks. If a packet allowed to the protected network contains malicious code, the entire
network will be infected whether you install a firewall or not. Another technology is the intrusion
detection system，and it is an effective complement to firewall technology. Intrusion detection is an
active technology which monitors the behaviors of a host or a network and alerts the administrator
when it detects the suspicious network behavior.
In general, the detection approaches for intrusion detection system can be divided into two
categories: misuse detection and anomaly detection.
Misuse detection defines and collects the abnormal patterns firstly, then it will check every incoming
and outgoing packet. Any action that conforms to the abnormal pattern is considered intrusive. The
main advantage of misuse detection is its high detection accuracy, and any intrusion can be detected
accurately if its pattern is collected in the rule library of the intrusion detection system. But misuse
detection systems perform very poorly to detect new attacks [2–8]. Therefore, there are few intrusion
detection systems use misuse detection approach alone.
