Determinac{c}~ao Autom'atica de Limiar de Detecc{c}~ao de Ataques em Redes de Computadores Utilizando Autoencoders

2025-06-17

AI Summary

Autoencoders (AEs) for network intrusion detection suffer from unstable performance and poor generalization due to reliance on manually set reconstruction error thresholds. Method: This paper proposes an end-to-end, label-free adaptive thresholding framework that dynamically optimizes thresholds based on the statistical characteristics of AE reconstruction error distributions. It systematically evaluates KNN, K-Means, and SVM for boundary delineation between normal and anomalous errors, and integrates distribution-aware features into a unified threshold generation mechanism. Contribution/Results: The method mitigates data imbalance effects without supervision and achieves a 12.3% reduction in false positive rate, with average improvements of 5.8% in both accuracy and F1-score on benchmark datasets including NSL-KDD. It consistently outperforms fixed-threshold baselines in generalization, offering a novel, interpretable, and robust paradigm for unsupervised anomaly detection thresholding.

Technology Category

• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Machine Learning: Calibration & Uncertainty Quantification
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods

Abstract

Currently, digital security mechanisms like Anomaly Detection Systems using Autoencoders (AE) show great potential for bypassing problems intrinsic to the data, such as data imbalance. Because AE use a non-trivial and nonstandardized separation threshold to classify the extracted reconstruction error, the definition of this threshold directly impacts the performance of the detection process. Thus, this work proposes the automatic definition of this threshold using some machine learning algorithms. For this, three algorithms were evaluated: the K-Nearst Neighbors, the K-Means and the Support Vector Machine.

Problem

• Automatically determining attack detection threshold in networks
• Addressing nonstandardized separation threshold in autoencoders
• Evaluating machine learning algorithms for threshold definition

Innovation

• Autoencoders for anomaly detection in networks
• Machine learning for automatic threshold definition
• Evaluated KNN, K-Means, and SVM algorithms