
Classification features are crucial for an intrusion detection system (IDS), and the detection performance of IDS will change dramatically when providing different input features. Moreover, the large number of network traffic and their high-dimensional features will result in a very lengthy classification process. Recently, there is an increasing interest in the application of deep learning approaches for classification and learn feature representations. So, in this paper, we propose using the stacked sparse autoencoder (SSAE), an instance of a deep learning strategy, to extract high-level feature representations of intrusive behavior information. The original classification features are introduced into SSAE to learn the deep sparse features automatically for the first time. Then, the low-dimensional sparse features are used to build different basic classifiers. We compare SSAE with other feature extraction methods proposed by previous researchers. The experimental results both in binary classification and multiclass classification indicate the following: 1) the high-dimensional sparse features learned by SSAE are more discriminative for intrusion behaviors compared to previous methods and 2) the classification process of basic classifiers is significantly accelerated by using high-dimensional sparse features. In summary, it is shown that the SSAE is a feasible and efficient feature extraction method and provides a new research method for intrusion detection.
machine learning, SSAE, feature extraction, deep learning, Intrusion detection, Electrical engineering. Electronics. Nuclear engineering, TK1-9971
machine learning, SSAE, feature extraction, deep learning, Intrusion detection, Electrical engineering. Electronics. Nuclear engineering, TK1-9971
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 150 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Top 1% | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Top 1% | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Top 1% |
