Autoencoder Hidden Layer Network Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network intrusion detection systems using autoencoders are inefficient due to the fixed detection time and low efficiency in handling data with a high degree of abnormality, as they do not effectively utilize the information from all hidden layers and require extensive analysis time, often taking days to months to identify attack patterns.
Innovation Solution
A hierarchical network intrusion detection system that utilizes the hidden layer information of an autoencoder by normalizing and preprocessing data, calculating reconstruction errors, and setting threshold values to determine anomalies through anomaly scores across multiple hidden layers, allowing for real-time detection and improved efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If traditional intrusion detection methods are used to analyze traffic and logs, then detection accuracy can be maintained, but detection time increases to several days to several months
Solution Approach 1:
The patent segments the detection process into multiple hidden layers of an autoencoder neural network. Each layer processes and analyzes features at different levels of abstraction, enabling parallel processing of multiple detection criteria simultaneously. This segmentation allows the system to evaluate numerous potential attack patterns concurrently rather than sequentially, dramatically reducing detection time while maintaining comprehensive analysis.
Solution Approach 2:
The patent replaces traditional manual or rule-based mechanical analysis methods with an automated neural network system. The autoencoder learns complex patterns and anomalies automatically from training data without requiring explicit programming of detection rules. This substitution of automated machine learning for manual analysis eliminates the time-consuming nature of traditional methods while improving detection speed and consistency.
2Measurement precision
If only input data and output data of autoencoder are used for training, then training simplicity is maintained, but detection accuracy deteriorates due to lack of hidden layer information utilization
Solution Approach 1:
The patent adds another dimension to the training process by incorporating outputs from multiple hidden layers of the autoencoder. Instead of using only the final output layer, the system utilizes representations from intermediate layers, effectively adding depth to the feature extraction process. This multi-dimensional approach captures both high-level abstract patterns and lower-level detailed features, improving detection accuracy without requiring a fundamentally different system architecture.
Solution Approach 2:
The patent makes the autoencoder system multi-functional by using the same network structure for both data reconstruction and anomaly detection. The hidden layers serve dual purposes: compressing data for reconstruction while simultaneously extracting meaningful features for intrusion detection. This universality allows the system to leverage a single trained model for multiple objectives, reducing overall system complexity while enhancing detection capabilities.
3Productivity
If fixed detection time is used after passing through all hidden layers, then system simplicity is maintained, but detection efficiency deteriorates due to delayed detection of highly abnormal data
Solution Approach 1:
The patent introduces dynamic detection timing based on the anomaly scores produced at each hidden layer. Instead of a fixed detection time, the system adaptively determines when to flag an intrusion based on the abnormality level observed at intermediate layers. Highly abnormal data can be detected early at shallower layers, while less obvious anomalies continue processing to deeper layers. This dynamic approach optimizes detection efficiency by reducing unnecessary processing time for clearly malicious traffic while maintaining thorough analysis for subtle threats.
Data Source
AI summary
The present disclosure provides a hierarchical network intrusion detection method including preprocessing normal data for training, outputting reconstruction data by inputting the preprocessed normal data for training into an autoencoder, calculating a reconstruction error by using the preprocessed normal data for training and the reconstruction data, training the autoencoder to minimize a reconstruction error, extracting hierarchical information of the autoencoder, setting a threshold value by using latent vector for the normal data for training, the reconstruction data, and an output value of each of L hidden layers included in an encoder, calculating anomaly scores of the latent vector for the network data, the reconstruction data, and an output value of each of the L hidden layers in a state in which a target network data is input to the autoencoder, and determining whether an intrusion into the network data is detected by using the threshold value and the anomaly scores.