Self-Organizing Map assisted Deep Autoencoding Gaussian Mixture Model for Intrusion Detection

TL;DR

This paper introduces SOMDAGMM, a novel model combining self-organizing maps with deep autoencoding Gaussian mixture models to enhance network intrusion detection accuracy by preserving input topology.

Contribution

The paper presents a new SOM-assisted DAGMM that maintains input space topology, improving intrusion detection performance over existing methods.

Findings

Outperforms state-of-the-art DAGMM on all tested datasets.

Achieves up to 15.58% improvement in F1 score.

Demonstrates better stability in detection results.

Abstract

In the information age, a secure and stable network environment is essential and hence intrusion detection is critical for any networks. In this paper, we propose a self-organizing map assisted deep autoencoding Gaussian mixture model (SOMDAGMM) supplemented with well-preserved input space topology for more accurate network intrusion detection. The deep autoencoding Gaussian mixture model comprises a compression network and an estimation network which is able to perform unsupervised joint training. However, the code generated by the autoencoder is inept at preserving the topology of the input space, which is rooted in the bottleneck of the adopted deep structure. A self-organizing map has been introduced to construct SOMDAGMM for addressing this issue. The superiority of the proposed SOM-DAGMM is empirically demonstrated with extensive experiments conducted upon two datasets. Experimental results show that SOM-DAGMM outperforms state-of-the-art DAGMM on all tests, and achieves up to 15.58% improvement in F1 score and with better stability.