|
Next I will describe these three steps in detail.
STEP1: Data preprocessing. The two benchmark data sets NSL-KDD and CSE-CIC-IDS2018 used in the experiment need to be preprocessed.
STEP2: Feature selection. Recursive feature addition algorithm is applied to select the optimal subset of features.
STEP3: Anomaly detection. The anomaly detection part is composed of autoencoder and k-means. After feature selection, AP clustering algorithm is used to group feature subsets. Each features group corresponds to an autoencoder. These autoencoders ensembles compose the core of the anomaly detection module. The normal network data is used to train the detection model. After the model is deployed, the autoencoder processes the new incoming traffic and calculates the RMSE. The RMSE value is used to determine whether the network traffic is normal. K-means algorithm clusters the results according to the RMSE value. |