Determina\c{c}\~ao Autom\'atica de Limiar de Detec\c{c}\~ao de Ataques em Redes de Computadores Utilizando Autoencoders

TL;DR

This paper proposes an automatic threshold determination method for anomaly detection in network security using autoencoders, employing machine learning algorithms to improve detection performance.

Contribution

It introduces a novel approach to automatically define detection thresholds in autoencoder-based anomaly detection systems using three machine learning algorithms.

Findings

K-Nearest Neighbors effectively set thresholds for attack detection.

Support Vector Machine improved detection accuracy.

Automated threshold setting enhanced overall system performance.

Abstract

Currently, digital security mechanisms like Anomaly Detection Systems using Autoencoders (AE) show great potential for bypassing problems intrinsic to the data, such as data imbalance. Because AE use a non-trivial and nonstandardized separation threshold to classify the extracted reconstruction error, the definition of this threshold directly impacts the performance of the detection process. Thus, this work proposes the automatic definition of this threshold using some machine learning algorithms. For this, three algorithms were evaluated: the K-Nearst Neighbors, the K-Means and the Support Vector Machine.