Machine Learning (ML) and Deep Learning (DL) have been used for building Intrusion Detection Systems (IDS). The increase in both the number and sheer variety of new cyber-attacks poses a tremendous challenge for IDS solutions that rely on a database of historical attack signatures. Therefore, the industrial pull for robust IDSs that are capable of flagging zero-day attacks is growing. Current outlier-based zero-day detection research suffers from high false-negative rates, thus limiting their practical use and performance. This paper proposes an autoencoder implementation for detecting zero-day attacks. The aim is to build an IDS model with high recall while keeping the miss rate (false-negatives) to an acceptable minimum. Two well-known IDS datasets are used for evaluation—CICIDS2017 and NSL-KDD. In order to demonstrate the efficacy of our model, we compare its results against a One-Class Support Vector Machine (SVM). The manuscript highlights the performance of a One-Class SVM when zero-day attacks are distinctive from normal behaviour. The proposed model benefits greatly from autoencoders encoding-decoding capabilities. The results show that autoencoders are well-suited at detecting complex zero-day attacks. The results demonstrate a zero-day detection accuracy of 89–99% for the NSL-KDD dataset and 75–98% for the CICIDS2017 dataset. Finally, the paper outlines the observed trade-off between recall and fallout.

中文翻译：

---

利用深度学习技术进行有效的零日攻击检测

机器学习（ML）和深度学习（DL）已用于构建入侵检测系统（IDS）。对于依赖历史攻击特征数据库的IDS解决方案，新的网络攻击的数量和种类之多都构成了巨大的挑战。因此，能够标记零日攻击的健壮IDS在工业上的吸引力正在增长。当前基于异常值的零日检测研究遭受较高的假阴性率，从而限制了它们的实际使用和性能。本文提出了一种用于检测零时差攻击的自动编码器实现。目的是建立具有较高召回率的IDS模型，同时将未命中率（假阴性）保持在可接受的最小值。评估使用了两个著名的IDS数据集-CICIDS2017和NSL-KDD。为了证明我们模型的有效性，我们将其结果与一类支持向量机（SVM）进行比较。该手稿强调了零日攻击与正常行为截然不同的一类SVM的性能。所提出的模型极大地受益于自动编码器的编码-解码功能。结果表明，自动编码器非常适合检测复杂的零日攻击。结果表明，NSL-KDD数据集的零日检测准确度为89–99％，CICIDS2017数据集的零日检测准确度为75–98％。最后，本文概述了观察到的回忆和后果之间的权衡。结果表明，自动编码器非常适合检测复杂的零日攻击。结果表明，NSL-KDD数据集的零日检测准确度为89–99％，CICIDS2017数据集的零日检测准确度为75–98％。最后，本文概述了观察到的回忆和后果之间的权衡。结果表明，自动编码器非常适合检测复杂的零日攻击。结果表明，NSL-KDD数据集的零日检测准确度为89–99％，CICIDS2017数据集的零日检测准确度为75–98％。最后，本文概述了观察到的回忆和后果之间的权衡。