Unsupervised Anomaly Detection in NSL-KDD Using $\beta$-VAE: A Latent Space and Reconstruction Error Approach

TL;DR

This paper presents an unsupervised anomaly detection method for network traffic using $eta$-VAE, comparing latent space distance and reconstruction error on the NSL-KDD dataset, demonstrating the effectiveness of latent space analysis.

Contribution

It introduces a novel application of $eta$-VAE for unsupervised anomaly detection in network traffic and compares two different approaches within this framework.

Findings

Latent space distance method outperforms reconstruction error in detection accuracy.

Exploiting latent space structure enhances classification performance.

Reconstruction error remains a viable baseline for anomaly detection.

Abstract

As Operational Technology increasingly integrates with Information Technology, the need for Intrusion Detection Systems becomes more important. This paper explores an unsupervised approach to anomaly detection in network traffic using $\beta$-Variational Autoencoders on the NSL-KDD dataset. We investigate two methods: leveraging the latent space structure by measuring distances from test samples to the training data projections, and using the reconstruction error as a conventional anomaly detection metric. By comparing these approaches, we provide insights into their respective advantages and limitations in an unsupervised setting. Experimental results highlight the effectiveness of latent space exploitation for classification tasks.