See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/354914936

Autoencoder-based IDS for cloud and mobile devices

Conference Paper · May 2021

DOI: 10.1109/CCGrid51090.2021.00088

CITATIONS READS
15 256

3 authors:

Kamil Faber Lukasz Faber

AGH University of Science and Technology in Kraków AGH University of Science and Technology in Kraków
21 PUBLICATIONS 109 CITATIONS 15 PUBLICATIONS 103 CITATIONS

SEE PROFILE SEE PROFILE

Bartłomiej Śnieżyński
AGH University of Science and Technology in Kraków
97 PUBLICATIONS 618 CITATIONS

SEE PROFILE

All content following this page was uploaded by Bartłomiej Śnieżyński on 04 October 2021.

The user has requested enhancement of the downloaded file.

 Autoencoder-based IDS for cloud and mobile
devices
Kamil Faber∗ , Lukasz Faber† and Bartlomiej Sniezynski‡
Institute of Computer Science
AGH University of Science and Technology
Cracow, Poland
Email: ∗ [email protected], † [email protected], ‡ [email protected]

Abstract—Along with the popularization of cloud computing in a study of intrusion detection techniques in mobile cloud
and the increase in responsibilities of mobile devices, there is a computing environments in [3].
need for intrusion detection systems available for working in these In this work, we propose a novel idea of an autoencoder-
two new areas. At the same time, the increase in computational
power of mobile devices gives us the possibility to use them to do based intrusion detection system, which have the following
a part of data preprocessing. Similarly, more complex operations features:
can be executed in the cloud – this concept is known as mobile • It works on network flows data, without analyzing
cloud computing. In this paper, we propose an autoencoder-based
packet’s payload, which allows to work with encrypted
intrusion detection system applicable to cloud and mobile envi-
ronments. The system provides multiple data gathering points, traffic and protects users privacy.
allowing to monitor either fully controlled networks, like virtual • It allows us to monitor mobile devices and detect anoma-
networks in the cloud, or mobile devices scattered in different lies in their behavior, therefore to notify their user about
networks. The monitoring process uses both mobile devices and possible intrusion.
cloud computational power. Gathered network traffic records
• It allows us to monitor networks in which we have access
are sent to a proper intrusion detection node, which executes the
detection process. In case of suspicious behavior, an alert of a to all packets passing through (using packet sniffing) –
possible intrusion can be sent to the device owner. The detection like virtual networks in cloud environments.
process is based on an autoencoder neural network, which brings • It can use mobile devices computing power to do some
significant advantages: an anomaly-based approach, training preprocessing, but most of the computation is done out-
only on benign samples, and a good performance. To improve
side those devices.
detection results, we created time-window-based features, and
there is also a possibility to share computed statistics between • It shares data between different networks.
intrusion detection nodes. In the experiments, we construct three • It uses a neural network – autoencoder – to execute
models using pure network flows data and time-window-based intrusion detection with an anomaly-based approach.
features. The results show that the autoencoder-based approach
can detect with a high performance attacks not known during In the next section, we shortly overview related works, in-
the training process. We also prove that created derived features cluding machine learning methods used in intrusion detection,
have a significant impact on detection results. cloud-based IDS, and an autoencoder architecture. Then, we
Index Terms—intrusion detection system, autoencoder, ma- describe the proposed intrusion detection system indicating
chine learning, security, mobile cloud computing its most essential features. After that, we run experiments
to show that the proposed autoencoder-based approach is
I. I NTRODUCTION suitable for intrusion detection on network flows. There are
significant improvements if we use derived time-window-
As the years go by, the number of devices connected to the
based features. At the end, we summarize our conclusions and
global network grows steadily. According to the IoT Analytics
indicate possible future works.
report by [1], there are almost 22 billion active connected
devices worldwide. Simultaneously, the number of hacker II. R ELATED WORKS
attacks increases – according to [2], in 2020 Q2, the number of
unique incidents grew by 59% compared to the previous year. A. Intrusion Detection Systems
A significant part of providing security is analyzing network There are two main classifications for intrusion detection
traffic to detect abnormal behaviors, which can signal that systems, discussed by [4]. One is based on a detection method,
the system is under attack. This task is usually carried by and the second one on a place where the detection process is
Intrusion Detection System (IDS), which is responsible for applied. Moreover, it is possible to differentiate two main cat-
detecting an intrusion and then alerting an administrator. With egories of detection methods. The first one is signature-based
the increasing use of the cloud architecture and mobile devices, intrusion detection, which bases on previously accumulated
there are new challenges that need to be faced, including the knowledge about attacks and vulnerabilities. Advantages and
possibility to monitor mobile devices and hosts located in disadvantages of such an approach were pointed out in many
different networks. More issues and challenges were indicated papers like [4] or [5]. The most crucial advantage is a low
false positive ratio and a high detection level of known attacks. In [11] the authors attempted to detect port scan attacks with
Unfortunately, this approach can not handle the detection of the Deep Neural Network (DNN) architecture. They used the
previously unknown attacks. Another category is anomaly- same data set that we use – CICIDS2017. They filtered only
based intrusion detection, which assumes that it is possible attacks labeled as port scans, and applied the down-sampling
to detect an intrusion by observing deviations from the users’ method to get a subset with balanced classes. The results
normal behavior or the system. It recognizes any abnormal achieved for port scan were very high – both the precision and
activity as an intrusion. The main advantage of anomaly-based recall had value 99%. In the same paper, they applied SVM
systems is that they can detect new, never-seen attacks, and architecture to the same task; however, it had low results – the
the main disadvantage is usually a high false positive ratio. precision at level 80% and the recall – 70%.
Other advantages and disadvantages were presented in [5], [6] The long short-term memory (LSTM) architecture (first
and [7]. proposed by [12]) is well-suited for tasks based on time and
Taking into account a source of data, intrusion detection sequence series data. Since network traffic is an example of
systems usually were divided into host-based (HIDS) and a time series, the LSTM was also applied in the intrusion
network-based intrusion detection systems (NIDS). In HIDS, detection problem. In [13] the authors implemented a classifier
data are gathered from hosts, while in NIDS, the detection can based on LSTM-RNN and compared it to other methods (like
base on pure information about network flows or, with a tech- KNN, SVM, PNN). LSTM was also tested on CIDDS-001
nique called Deep Packet Inspection, on extracted payload of data set by [14]. They tried a few different LSTM architectures
network packets. Recently, there were also multiple mentions and compared them to other methods (C4.5, Random Forest,
(for example, in [8]) about a distributed intrusion detection Hoeffding Tree, Naive Bayes, SVM). The experiment results
system (DIDS), which contains a lot of smaller detection nodes shown that LSTM achieves similar or better results like other
that can communicate with each other or with a centralized methods, which indicates that considering a perspective more
server. comprehensive than just a single network flow may improve
results.
B. Machine learning methods for intrusion detection Over the last few years, there have been a few approaches to
apply autoencoders – a particular type of neural network which
Machine learning techniques were used in the intrusion we also use in our approach. In [15] the authors proposed
detection problem for many years. However, recently, the a complex framework based on an ensemble of autoencoders
deep neural network architecture is becoming more and more with prior feature extraction, including window-based features.
popular and this trend also impacts intrusion detection. Many One of their main focus was creating a detection method
of the new research papers focus on applying deep learning capable of running online on devices with low resources. The
techniques in this domain. authors tested the proposed solution in a real environment
In [9] the authors provided a complex overview of deep built from a few IoT devices and achieved promising results.
learning approaches applied in intrusion detection task. They In [16] the authors applied a deep autoencoder trained in a
also listed the most important data sets used during the last greedy layer-wise way and tested it on KDD-99 data set. A
20 years. The authors applied seven deep learning models to similar approach, but with additional random-forest feature
two modern data sets – CSE-CIC-IDS2018 and the Bot-IoT. selection, was applied in [17]. In [18] the authors proposed
Their work provides valuable insights and a summary of many optimization of computational cost by using just one detector
machine learning approaches to the intrusion detection task. for most of the network flows and the second one only for
In [6], the authors did an overview of flow-based anomaly the most challenging cases. There were also approaches to
detection techniques, including the older ones and the most use specialized types of autoencoders – for example, in [19] a
modern ones. They indicated that the anomaly-based approach denoising autoencoder was applied and verified on NSL-KDD
working on network flows data has great potential and may data set, achieving high results.
answer the needs of the intrusion detection systems. However,
they also note that there are still many difficulties that need C. Cloud-based IDS
to be challenged, like minimizing the false positive ratio and A need to create intrusion detection systems explicitly
improving detection results. adapted for the cloud environment was mentioned and empha-
In [10] the authors applied deep neural networks with sized in [20] and in [8], in which the authors provided a study
three different architectures, each with three layers and with of challenges and solutions for cloud intrusion detection. There
different sizes of the hidden layer. They executed experiments is also a comprehensive study of computational intelligence
on the original data distribution and more balanced data intrusion detection techniques in mobile cloud computing
obtained using down-sampling, up-sampling, class balances, environments [3]. The authors compared data sets and methods
and spread sub-sampling. In the original distribution, they applied since the beginning of the cloud. They also indicated
were able to achieve an accuracy 99.65%. In other cases, their many open research issues, including the location of the IDS.
results were slightly worse. In the up-sampling and spread In [21] the authors proposed an intrusion detection method
sub-sample cases, the authors did not manage to achieve over using deep neural network architecture build with Improved
97%. Genetic. Their solution achieved good results in detecting

2
attacks basing on network flows from the data set used
also in our experiments, CICIDS2017. In [22] the authors
created a multi-layer neural network optimized with hybrid
glow swarm optimization–tabu search for intrusion detection
system in cloud environment. This optimization helped them
improve detection performance. The innovative, hypervisor-
level distributed network security framework was proposed in
[23] to increase the cloud’s security. The authors also applied
an anomaly-based detection method and tested it on three data
sets, including CICIDS2017. However, their work was more
Input Layer ∈ ℝ⁶ Hidden Layer ∈ ℝ² Output Layer ∈ ℝ⁶
focused on protecting services based in the cloud than on
mobile devices.
In [24] the authors proposed a hybrid intrusion detection Fig. 1. Structure of the shallow undercomplete autoencoder.
system, which comprises two parts – the first one for de-
tection on the virtual machines level and the second one for
According to [26], the autoencoders were initially usually
network threats detection, which is also our concern. Another
used for features learning and dimensionality reduction, as
innovative intrusion detection scheme, based on clustering
they achieve better results than PCA. However, in the last
algorithm and distance-based traffic filtration, was proposed
years, the autoencoders have much wider application – they
in [25]. The authors of [3] provided in-depth analysis and
are used, or example, in generative modeling and anomaly
overview of existing intrusion detection systems for mobile
detection. That last application is the main point of interest in
cloud computing. They also described open issues in this
that work.
research area, including the IDS location, heterogeneity of
Undercomplete autoencoder: One way to get useful prop-
environment, and lack of the up-to-date signatures.
erties in the hidden layer is to constrain the size of the code to
D. Autoencoder have a smaller dimension than the input. This approach should
force the autoencoder to capture the structure of the training
An autoencoder is a special type of neural network archi-
data. The autoencoder with the code dimension smaller than
tecture. We may consider it as built of three parts:
the input size is named undercomplete. Its sample structure is
1) Code: A code layer is a hidden layer placed between the presented in Figure 1.
encoder and the decoder. It represents a code h used to
encode the input. III. P ROPOSED SOLUTION
2) Encoder: The goal of the encoder is to transform the We propose a distributed IDS architecture that can monitor
input into the code. It can be formally written as: mobile devices and, at the same time, does most computation
h = f (x) (1) outside of those devices. We present the structure of the system
in figure 2. We can differentiate three main elements of the
where x the input and f is the encoding function proposed IDS:
provided by the encoder. • M – a set of Monitors;
3) Decoder: The goal of the decoder is transforming the • N – a set of Intrusion Detection Nodes;
code into the output, which reflects the previously en- • C – a set of connections between Monitors and Intrusion
coded input. It can be formally written as: Detection Nodes.
y = g(h) = g(f (x)) (2) Monitor is an element responsible for gathering data neces-
sary for the intrusion detection process, preprocessing them,
where y is the output, h the code and g is the decoding and sending them to Intrusion Detection Node (IDN). Every
function provided by the decoder. IDN receives data from a few Monitors and creates new
As indicated by [26], in a training phase, we do not want derived features based on the time-window. In the next step,
the autoencoder to learn to simply copy an input, as it would it shares computed statistics with other IDNs to improve
not be advantageous. The goal is to restrict the model so that it detection performance. The core work of the IDN is to execute
must do an approximate copy. As a result, we force the model an anomaly-based detection process. We provide the details of
to choose which aspects of the input it should copy. Thanks to every part of the system in the further paragraphs.
that, the autoencoder is often able to learn valuable properties
of the data. A. Gathering data in IDS
We may consider the autoencoder as a particular case of a The data used by the proposed IDS are records of bidirec-
feedforward network and train it with all the same techniques. tional network flows. There is no need to analyze the contents
The goal of the learning process is minimizing the given loss of the paylods of the packets. This approach results in two
function, which is calculated by comparing the input and the critical advantages: the ability to handle encrypted traffic and
output of the model. the protection of users’ privacy.

3
 Fig. 2. A structure of the proposed IDS.

We differentiate two cases of data gathering and, therefore, are network flows from some period. They can be limited
two types of Monitors. As the first case, we consider a situation either by time measurement (for example, 10 minutes) or a
in which there is a possibility to monitor the whole traffic in number of last connections that should be stored (for example,
the network. It concerns cases like controlled local networks, last 100 connections). We create the following features based
cellular base stations, or virtual switches in some cloud on a time-window:
environments. As the second case, we consider monitoring 1) Number of connections from the source IP address;
mobile devices scattered in various networks, in which we do 2) Number of different destination ports referenced by the
not have access to the provider’s infrastructure and can not source IP address;
monitor them as a whole. In such a situation, we use those 3) Number of different pairs (destination IP, destination
mobile devices as monitoring points. All of them gather data port) referenced by the source IP address;
about their network traffic, preprocess them, and then send it 4) Number of connections to the same destination IP ad-
to the monitor, which forwards it to the intrusion detection dress;
node. 5) Number of connections to the same destination IP ad-
We can consider a case in which mobile devices are infected dress and destination port number;
and malware blocks or alters data before sending it to the 6) Total flows duration between source and destination IP
monitor. In such a situation, there are two possible scenarios. addresses.
If no data are sent, the intrusion detection node notices it
and notify the owner about the issue. If data received from a C. Data shared between Intrusion Detection Nodes
mobile device are altered to hide malware actions and pretend To improve computing derived features, we also consider a
to behave appropriately, the intrusion detection process may possibility to share data between Intrusion Detection Nodes.
not detect infection. However, it does not affect the ability of IDN can periodically send minimal statistics required to com-
the system to detect other intrusions. pute features 1-3 from the previous paragraph. The decision
B. Transforming data into features which nodes share data must find a balance between pros and
There are two steps of processing gathered data to features. cons. Sharing data between too many nodes may increase
The first one is done at Monitors or the monitored mobile data transfer and slow down the detection process. On the
devices. Raw network traffic records are transformed to basic other hand, narrowing data exchange too much may lower the
statistics describing every bidirectional network. Examples of detection ratio.
such features are the duration time of the network flow and D. Detection process
the number of bytes sent in the flow. This process can be done
using tools like CICFlowMeter provided by [27]. Detection process is executed by autoencoders – the neural
The second step is executed at Intrusion Detection Node, network architecture shortly introduced in section II-D. There
and it includes computing statistics based on a broader per- are several reasons why we decided to use autoencoders:
spective than the one available for a single monitor. The • Anomaly detection based approach;
purpose of those derived features is to improve detection • Good performance and detection results;
performance. They are computed based on data gathered from • A training phase requires only a benign class;
all Monitors assigned to the given Intrusion Detection Node • Possibility to improve a model with the use of incremen-
and grouped into so-called time-window. Time-window data tal learning.

4
Below, we shortly explain how we apply the autoencoder in Database and using them to improve the model in the Training
the intrusion detection problem. Module. The model can be fully retrained or improved with
1) Training phase: The first step is training the model so the use of incremental learning. After that, the new model can
that it learns the characteristics of the benign network traffic. be uploaded to the intrusion detection nodes. That approach
A training process uses only normal data. The goal of the requires administrators activity, as they must decide when the
model is to minimize the value of reconstruction error. We use model should be retrained and filter training samples so that
Mean Squared Error as a loss function – mean of the squares they contain only benign traffic.
of the differences between the output and the input. During
the training phase, the autoencoder learns how to reconstruct G. Potential of scalability
samples from typical characteristics. It means that it should The distributed nature of the proposed intrusion detection
provide a low reconstruction error for a benign sample. system also makes it easier to scale. The first issue to consider
2) Detection phase: In a detection process, the model is is creating smaller subsets of intrusion detection nodes that
used to reconstruct an input sample. After that, we calculate a share data between them but not between all the detection
reconstruction error comparing predicted values to the original nodes. It may have a slight negative impact on detection
input. If the reconstruction error is high, it indicates that results, but at the same time, it minimizes the volume of shared
the sample is from different characteristics than the training data.
data and therefore can be classified as an anomaly. It can be We also should consider whether the central traffic database
formally written as: will become a bottleneck. As the database’s primary goal
( is to provide data for the training module, we do not have
Normal, if RE ≤ Threshold to send and store all records of network flows there. As
Label = (3)
Anomaly, if RE > Threshold we mentioned in section III-F, this process requires only
periodic gathering records of network traffic. We can also
where
have a separate traffic database and training module for every
RE = p(g(f (x)) − x) (4)
separated subset of intrusion detection nodes. This approach
where RE is a Reconstruction Error and p is a metric function can lead to the creation of models specialized for a particular
(in our case the mean squared error) and the threshold for a part of the network. However, there is still a need to examine
cut-off point is chosen arbitrarily. The choice of the threshold in which situations it will improve detection results and in
should be made concerning the potential cost of false positives which it can have a negative impact.
and false negatives. All anomalies are classified as malicious
traffic. In our experiments we do not choose a single value of IV. E XPERIMENTS
the threshold, we show true positives ratio results for a few Experiments concentrate on testing the proposed approach
false positives values. to detect intrusions at Intrusion Detection Node. We set the
following goals for them:
E. Notification for mobile device owner
• We would like to show that the proposed autoencoder-
If an intrusion detection node detects some suspicious based architecture is suitable for the intrusion detection
behavior originating from an end-type device monitored by task using network flows as input data.
Monitors, notification about it may be sent to this device. • We would like to show improvement in detection perfor-
Therefore, it is possible to inform an owner of the device mance due to derived features based on a time-window.
(for example, a mobile phone) about suspicious behavior and
In the experiments, we compare the effectiveness of three
a possible threat (malware, access without permission). It can
types of models:
be achieved, for example, by the use of push notifications from
a dedicated mobile app or email messages to a user protected 1) Undercomplete autoencoder for single flow features;
by the system. This approach can help in the detection of 2) Undercomplete autoencoder for single flow features and
compromised mobile devices, while at the same time, it does prepared by us window-based features, where the win-
not require running the whole detection process on mobile dow contains last 100 samples;
devices. Thanks to that, it is possible to optimize how much 3) Undercomplete autoencoder for single flow features and
computation is done on the mobile phone while moving the window-based features, where the window contains sam-
rest to the Monitors or Intrusion Detection Nodes. ples from the last 10 minutes.
The hyperparameters in the used models were chosen
F. Model retraining manually based on many executions of experiments and are
In real-life situations, the characteristic of network traffic presented in tables I and II.
is not constant – it evolves due to changes in infrastructure To evaluate proposed models, we use CICIDS2017 [28] –
or users’ behavior. Such changes are known as concept drift. a modern data set generated by the Canadian Institute for
To keep the models up to date, the system should be extended Cybersecurity. In [29], a comprehensive survey of available
with the possibility to improve the model with time. It requires data sets for network-based intrusion detection, the authors
periodic gathering records of network traffic in the Traffic reviewed 35 different data sets, analyzing them from the

5
 TABLE I TABLE III
A RCHITECTURE OF THE UNDERCOMPLETE AUTOENCODER ( MODEL 1). ROC-AUC VALUES FOR ALL USED MODELS .

L. no. Type Size Activation function Model ROC-AUC

1 Input 79 – 1 Single flow features 0.884
2 Dense 36 relu 2 100 samples window 0.926
3 Output 79 sigmoid 3 10 minutes window 0.988

TABLE II TABLE IV
A RCHITECTURE OF THE UNDERCOMPLETE AUTOENCODER WITH FPR AND TPR PAIRS FOR THE EXPERIMENTS .
TIME - WINDOW- BASED FEATURES ( MODELS 2 AND 3).
FPR 0 0.001 0.01 0.05
L. no. Type Size Activation function Model 1 0 0.36 0.50 0.60

TPR
1 Input 85 – Model 2 0.0 0.28 0.42 0.49
2 Dense 36 relu Model 3 0.34 0.79 0.89 0.94
3 Output 85 sigmoid

precise values easier than from a ROC plot and provides

perspective of 15 various properties. They have shown that an easy way to compare the model’s ability to achieve a
CICIDS2017 is a significant improvement compared to the high detection rate while keeping a low false detection
previous ones. It contains 3.1M network flows gathered in an rate.
emulated environment over five days. Normal user behavior
We provide the ROC-AUC values for every model in the
was generated by Benign Profile Agent simulating 25 users,
table III, while FPR and TPR pairs are in the table IV. We
while attacks were executed with the use of common tools.
also present the ROC-AUC values for model 3 for every attack
The data set contains the following attacks: DoS GoldenEye,
in the table V and confusion matrix for model 3 in the table
Heartbleed, DoS Hulk, DoS Slowhttp, DoS slowloris, SSH-
VI. Below we provide a thorough analysis of those results,
Patator, FTP-Patator, Web Attack, Infiltration, Bot, PortScan,
and we also show detailed results for different attacks.
and DDoS. Gathered network flows were transformed into 80
features by CICFlowMeter [27]. In our experiments, we use all Impact of working with more than a single network flow
of them except for timestamp. Details of the creation process
Looking at the results in the table IV we can see that
and data set description are provided in [28]. The authors
adding time-window-based features significantly improves re-
followed the criteria of a benchmark data set defined in [30].
sults achieved by models. The second and the third models
The choice of executed attacks bases on a list of currently
are significantly better in detecting malicious traffic than the
common attack families, and some have built-in obfuscation.
It is suitable for our experiments as it contains records of
network flows and can simulate network traffic present in the TABLE V
cloud. Before experiments, we cleaned data removing records ROC-AUC VALUES FOR EVERY ATTACK IN MODEL 3
with missing values. We also applied MinMaxScaler from
scikit-learn python library. Detailed analysis of the data set Attack type ROC-AUC Attack type ROC-AUC
was provided in [31]. Bot 0.850 Heartbleed 0.999
DDoS 0.998 Infiltration 0.980
V. A NALYSIS OF THE RESULTS
DoS GoldenEye 0.991 PortScan 0.990
To evaluate the results of experiments, we decided to use
the following metrics: DoS Hulk 0.999 SSH Patator 0.817

• Receiver Operating Characteristic (ROC) curve plot DoS Slowhttptest 0.980 Web Brute Force 0.635
shows a true positive rate (TPR) against a false positive DoS slowloris 0.907 SQL Injection 0.898
rate (FPR) [32]. TPR is also known as a detection rate FTP-Patator 0.792 Web XSS 0.600
and FPR as a false alarm rate.
• ROC-AUC is the Area Under ROC Curve. We decided to
TABLE VI
use ROC-AUC because those two metrics are very intu- C ONFUSION MATRIX FOR FPR=0.01 ( MODEL 3)
itive for the intrusion detection problem, as they provide
dependence between TPR and FPR. It is beneficial, as Actual
detection rate and false alarm rates are very natural and P N
easy to interpret in the considered context.
Predict

P 499211 4543
• A table with typical false positive rates (0.001, 0.01, 0.05)
N 57345 449720
and corresponding true positive rates. It allows to read

6
 Bot DDoS DoS GoldenEye
1.0 1.0 1.0
0.8 0.8 0.8
0.6 0.6 0.6

TPR
0.4 0.4 0.4
0.2 0.2 0.2
0.0 0.0 0.0
0.00 0.25 0.50 0.75 1.00 0.00 0.25 0.50 0.75 1.00 0.00 0.25 0.50 0.75 1.00
DoS Hulk DoS Slowhttptest DoS slowloris
1.0 1.0 1.0
0.8 0.8 0.8
TPR 0.6 0.6 0.6
0.4 0.4 0.4
0.2 0.2 0.2
0.0 0.0 0.0
0.00 0.25 0.50 0.75 1.00 0.00 0.25 0.50 0.75 1.00 0.00 0.25 0.50 0.75 1.00
FTP-Patator Heartbleed Infiltration
1.0 1.0 1.0
0.8 0.8 0.8
0.6 0.6 0.6
TPR

0.4 0.4 0.4

0.2 0.2 0.2
0.0 0.0 0.0
0.00 0.25 0.50 0.75 1.00 0.00 0.25 0.50 0.75 1.00 0.00 0.25 0.50 0.75 1.00
PortScan SSH-Patator Web Attack Brute Force
1.0 1.0 1.0
0.8 0.8 0.8
0.6 0.6 0.6
TPR

0.4 0.4 0.4

0.2 0.2 0.2
0.0 0.0 0.0
0.00 0.25 0.50 0.75 1.00 0.00 0.25 0.50 0.75 1.00 0.00 0.25 0.50 0.75 1.00
FPR
Web Attack Sql Injection Web Attack XSS
1.0 1.0
0.8 0.8
0.6 0.6
TPR

0.4 0.4
0.2 0.2
0.0 0.0
0.00 0.25 0.50 0.75 1.00 0.00 0.25 0.50 0.75 1.00
FPR FPR

Fig. 3. ROC curves for every attack type in the experiment 3.

undercomplete model with only single network flow features By comparing results for model 1 (single flows) and model
as input. 3 (10 minutes window), we observed the following results of
In Figure 3 we present our analysis of separate ROC curves adding time-window-based features:
for every label in experiment 3 (the model trained with features 1) The ability to detect DDoS attacks, DoS Hulk, PortScan
computed for 10 minutes window). was significantly improved.
We can notice that the following attacks are very well 2) The ability to detect SSH-Patator, FTP-Patator, and Bot
detected for the enhanced features set: DDoS, DoS GoldenEye, attacks was slightly improved.
DoS Hulk, DoS Slowhttptest, Heartbleed, Infiltration. Most of 3) There was no significant improvement in the detection
these attacks are based on sending many requests continuously, of Web Attacks.
which may be why time-window features improve their detec- The first conclusion seems to be pretty obvious – all these
tion. We can also notice that the mobile devices can be used attacks are based on sending many requests. The fascinating
in some of those attacks, like DDoS. Therefore, applying that thing is that the detection of FTP-Patator is much better, while
approach may improve the detection of compromised devices there is just a slight improvement in SSH-Patator detection.
and allow to notify the owners about possible threats. One possible explanation is that SSH protocol is encrypted

7
– however, solving this issue would require further studies. • Not all types of attacks can be detected with this ap-
Lack of improvement in the detection of Web Attacks can proach, probably because they are invisible from the
be explained by the fact that those attacks depend more on network flows perspective (like web attacks).
a packet payload than some time-window-based features (see
below). VI. C ONCLUSIONS
In this paper, we have proposed the autoencoder-based
Possibility of detecting all types of attacks intrusion detection system specifically designed to work in
As we have already described, the autoencoders can detect cloud and mobile environments. It can monitor both: networks,
some attacks using just features containing information about in which we have access to all packets passing through,
single data flows without a deep packet inspection. However, like in some virtual cloud environments, and mobile devices
even with the usage of time-window features, some attacks are scattered into various networks around the world. It is also
still undetectable, which means the proposed model cannot possible to notify the owners of the mobile devices that their
differentiate them from benign characteristics. It raises the devices may be compromised. Our experiments show that the
question about the possibility of detecting such attacks without autoencoder architecture, in connection with network flows
analyzing packets payload. The undetectable attacks are Web data and derived features, can achieve high detection results.
Attack Brute Force and Web Attack XSS. Therefore, it is suitable for use in the intrusion detection
It is not surprising that the model cannot detect web attacks, system operating in the cloud. However, it is worth noticing
as they are usually distinguished by packet payload or analysis that not all types of attacks can be detected with this approach
of logs from the victim device. From the perspective of due to the use of network flows data only.
network flows, web attacks may look like benign traffic. For In future works, we would like to focus on defining a
example, XSS may have the same packet’s characteristics. more generic framework for intrusion detection in cloud
The only difference may be in the packet’s payload, and its environments and preparing tools to monitor mobile devices.
analysis requires deep packet inspection. It is worth noticing Another attractive research area is automatizing the decision of
that web attacks usually are neither carried out by mobile whether preprocessing should be executed on a mobile device
devices nor targeted at mobile devices. Therefore, they are not or in the cloud, taking into account the computing power
the main problem from the perspective of protecting mobile and resources available on a given mobile device. It would
devices. There are also other methods allowing applicable on also be worthwhile to gather data other than network flows
application-level and capable of dealing with such attacks. from mobile devices and create new features to improve the
detection of compromised devices.
Comparison to the results of other studies
ACKNOWLEDGMENT
It is hard to compare our results to the ones achieved by
the authors of the data set [30]. We apply a different approach The research presented in this paper was supported by the
(anomaly detection instead of standard classifiers). We also funds assigned to AGH University of Science and Technology
do not know how many samples of each class their test data by the Polish Ministry of Science and Higher Education.
set contained. Our test data set contains 45% of benign traffic
and 55% of malicious traffic. The best results achieved by [30] R EFERENCES
were for algorithm ID3 (Iterative Dichotomiser 3): Precision = [1] Knud Lasse Lueth, “State of the IoT 2020,” tech. rep., 2020. Avail-
0.98 and Recall = 0.98. The results achieved by us for the able online: https://iot-analytics.com/state-of-the-iot-2020-12-billion-
third model (for 0.05 FPR value) are: Precision = 0.94 and iot-connections-surpassing-non-iot-for-the-first-time/.
[2] P. Technologies, “Cybersecurity threatscape: Q2 2020,” tech. rep.,
Recall = 0.95, which means that our results are similar (but 2019. Available online: https://www.ptsecurity.com/ww-en/analytics/
slightly worse) comparing to theirs. However, we should note cybersecurity-threatscape-2020-q2/.
that the authors of [30] trained an instance of a model for [3] S. Shamshirband, M. Fathi, A. Chronopoulos, A. Montieri, F. Palumbo,
and A. Pescapè, “Computational intelligence intrusion detection tech-
every single attack type. They also applied feature selection niques in mobile cloud computing environments: Review, taxonomy, and
on the full data set and chose 3 or 4 best features for every open research issues,” Journal of Information Security and Applications,
attack type. We use one model and train it with only benign vol. 55, 2020.
[4] H. Debar, M. Dacier, and A. Wespi, “Towards a taxonomy of intrusion-
traffic to check the model’s ability to detect previously unseen detection systems,” Computer Networks, vol. 31, pp. 805–822, apr 1999.
attacks. Therefore, an advantage of our approach is the lack [5] A. Khraisat, I. Gondal, P. Vamplew, and J. Kamruzzaman, “Survey
of need to know all attacks a priori. of intrusion detection systems: techniques, datasets and challenges,”
Cybersecurity, vol. 2, p. 20, dec 2019.
In the following points, we shortly summarize the results of [6] R. Sharma, A. Guleria, and R. Singla, “An overview of flow-based
the experiments: anomaly detection,” International Journal of Communication Networks
and Distributed Systems, vol. 21, no. 2, p. 220, 2018.
• The neural network autoencoder architecture can achieve [7] A. Patcha and J.-M. Park, “An overview of anomaly detection tech-
high results in the intrusion detection problem and, there- niques: Existing solutions and latest technological trends,” Computer
fore, suitable for use in intrusion detection nodes. Networks, vol. 51, pp. 3448–3470, aug 2007.
[8] Y. Mehmood, A. Shibli, U. Habiba, and R. Masood, “Intrusion detection
• New time-window-based derived features improve detec- system in cloud computing: Challenges and opportunities,” pp. 59–66,
tion results. 12 2013.

8
 [9] M. A. Ferrag, L. Maglaras, S. Moschoyiannis, and H. Janicke, “Deep [29] M. Ring, S. Wunderlich, D. Scheuring, D. Landes, and A. Hotho, “A
learning for cyber security intrusion detection: Approaches, datasets, and survey of network-based intrusion detection data sets,” Computers &
comparative study,” Journal of Information Security and Applications, Security, vol. 86, pp. 147–167, sep 2019.
vol. 50, p. 102419, feb 2020. [30] I. Sharafaldin, A. Gharib, A. H. Lashkari, and A. A. Ghorbani, “Towards
[10] R. Abdulhammed, M. Faezipour, A. Abuzneid, and A. AbuMallouh, a Reliable Intrusion Detection Benchmark Dataset,” Software Network-
“Deep and Machine Learning Approaches for Anomaly-Based Intrusion ing, vol. 2017, pp. 177–200, jan 2017.
Detection of Imbalanced Network Traffic,” IEEE Sensors Letters, vol. 3, [31] R. Panigrahi and S. Borah, “A detailed analysis of cicids2017 dataset for
pp. 1–4, jan 2019. designing intrusion detection systems,” vol. 7, pp. 479–482, 01 2018.
[11] D. Aksu and M. Ali Aydin, “Detecting Port Scan Attempts with [32] T. Fawcett, “An introduction to ROC analysis,” Pattern Recognition
Comparative Analysis of Deep Learning and Support Vector Machine Letters, vol. 27, pp. 861–874, jun 2006.
Algorithms,” in 2018 International Congress on Big Data, Deep Learn-
ing and Fighting Cyber Terrorism (IBIGDELFT), ANKARA, Turkey,
pp. 77–80, IEEE, dec 2018.
[12] S. Hochreiter and J. Schmidhuber, “Long Short-Term Memory,” Neural
Computation, vol. 9, pp. 1735–1780, nov 1997.
[13] J. Kim, J. Kim, H. L. T. Thu, and H. Kim, “Long Short Term
Memory Recurrent Neural Network Classifier for Intrusion Detection,”
in 2016 International Conference on Platform Technology and Service
(PlatCon), Jeju, South Korea, pp. 1–5, IEEE, feb 2016.
[14] L. Nicholas, S. Y. Ooi, Y. H. Pang, S. O. Hwang, and S.-Y. Tan, “Study
of long short-term memory in flow-based network intrusion detection
system,” Journal of Intelligent & Fuzzy Systems, vol. 35, pp. 5947–
5957, dec 2018.
[15] Y. Mirsky, T. Doitshman, Y. Elovici, and A. Shabtai, “Kitsune: An
Ensemble of Autoencoders for Online Network Intrusion Detection,”
feb 2018.
[16] F. Farahnakian and J. Heikkonen, “A deep auto-encoder based approach
for intrusion detection system,” in 2018 20th International Conference
on Advanced Communication Technology (ICACT), pp. 178–183, 2018.
[17] X. Li, W. Chen, Q. Zhang, and L. Wu, “Building auto-encoder intrusion
detection system based on random forest feature selection,” Computers
& Security, vol. 95, p. 101851, 2020.
[18] M. Gharib, B. Mohammadi, S. H. Dastgerdi, and M. Sabokrou, “Autoids:
Auto-encoder based method for intrusion detection system,” ArXiv,
vol. abs/1911.03306, 2019.
[19] R. C. Aygun and A. G. Yavuz, “Network Anomaly Detection with
Stochastically Improved Autoencoder Based Models,” in Proceedings
- 4th IEEE International Conference on Cyber Security and Cloud
Computing, CSCloud 2017 and 3rd IEEE International Conference of
Scalable and Smart Cloud, SSC 2017, pp. 193–198, Institute of Electrical
and Electronics Engineers Inc., jul 2017.
[20] A. Patel, M. Taghavi, K. Bakhtiyari, and J. Celestino Júnior, “An intru-
sion detection and prevention system in cloud computing: A systematic
review,” Journal of Network and Computer Applications, vol. 36, no. 1,
pp. 25 – 41, 2013.
[21] Z. Chiba, N. Abghour, K. Moussaid, A. El Omri, and M. Rida,
“Smart approach to build a deep neural network based ids for cloud
environment using an optimized genetic algorithm,” in Proceedings of
the 2nd International Conference on Networking, Information Systems
& Security, NISS19, (New York, NY, USA), Association for Computing
Machinery, 2019.
[22] M. Manickam and S. Rajagopalan, “A hybrid multi-layer intrusion de-
tection system in cloud,” Research Journal of Biotechnology, vol. 2017,
pp. 167–174, 03 2019.
[23] R. Patil, H. Dudeja, and C. Modi, “Designing an efficient security frame-
work for detecting intrusions in virtual network of cloud computing,”
Computers and Security, vol. 85, pp. 402–422, 2019.
[24] H. Toumi, A. Eddaoui, and M. Talea, “Cooperative intrusion detection
system framework using mobile agents for cloud computing,” Journal of
Theoretical and Applied Information Technology, vol. 70, no. 1, pp. 76–
84, 2014.
[25] S. Dey, Q. Ye, and S. Sampalli, “A machine learning based intrusion de-
tection scheme for data fusion in mobile clouds involving heterogeneous
client networks,” Information Fusion, vol. 49, pp. 205–215, 2019.
[26] A. Goodfellow, Ian; Bengio, Yoshua; Courville, Deep learning, MIT
Press, vol. 26. 2016.
[27] Canadian Institute for Cybersecurity, “CICFlowmeter - Network Traffic
Flow analyzer,” 2021. Available online: https://github.com/ahlashkari/
CICFlowMeter.
[28] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward Generating
a New Intrusion Detection Dataset and Intrusion Traffic Characteriza-
tion,” pp. 108–116, aug 2019.

View publication stats