Harnessing DBSCAN and auto-encoder for hyper intrusion detection in cloud computing

Abstract

The widespread availability of internet services has led to a surge in network attacks, raising serious concerns about cybersecurity. Intrusion detection systems (IDS) are pivotal in safeguarding networks by identifying malicious activities, including denial of service (DoS), distributed denial of service (DDoS), botnet, brute force, probe, remote-to-local, and user-to-root attacks. To counter these threats effectively, this research focuses on utilizing unsupervised learning to train detection models. The proposed method involves employing auto-encoders (AE) for attack detection and density-based spatial clustering of applications with noise (DBSCAN) for attack clustering. By using preprocessed and unlabeled normal network traffic data, the approach enables the identification of unknown attacks while minimizing the impact of imbalanced training data on model performance. The auto-encoder method utilizes the reconstruction error as an anomaly detection metric, while DBSCAN employs a density-based approach to identify clusters, manage noise, accommodate diverse shapes, automatically determine cluster count, ensure scalability, and minimize false positives. Tested on standard datasets such as KDDCup99, UNSW-NB15, CICIDS2017, and CSE-CIC-IDS2018, this proposed model achieves accuracies exceeding 98.36%, 98.22%, 98.45%, and 98.51%, respectively. These results demonstrate the effectiveness of unsupervised learning in detecting and clustering novel intrusions while managing imbalanced data.