Mask-based Self-supervised Network Intrusion Detection System

Abstract

A significant number of network intrusion detection systems utilize unsupervised anomaly detection methodologies, the majority of which fail to account for the potential for contamination in the data, resulting in suboptimal detection outcomes.This paper proposes an unsupervised method, designated MS-IDS (Mask-based Self-supervised Network Intrusion Detection System), which employs the techniques of mask shielding and Stacked Sparse Autoencoder (SSAE).MS-IDS is trained on data that has been contaminated in some way, generating a variety of masks through the process of learning. These masked inputs are subsequently reconstructed by SSAE. A composite loss function is devised, encompassing losses from both the mask unit and the SSAE. During the training phase, the combined loss function is optimized with the objective of identifying the optimal parameters and transformations for the SSAE. In the testing phase, the loss function assigns a score to each sample, which is used to classify outliers based on their scores. The performance of MS-IDS was evaluated across four intrusion datasets: The datasets used for evaluation were NSL-KDD, CIC-IDS2017, ToN-IoT, and CIC-DDOS2019. The results demonstrate that even when varying levels of contamination are introduced into the benign traffic, MS-IDS maintains robust performance with minimal decline. Notably, MS-IDS outperforms other models in terms of accuracy, AUC-ROC, and F1 scores, and its ability to detect attacks in contaminated data undergoes significant enhancement.