MVNIDS: A multiview-based network intrusion detection system

Abstract

Traditional Network Intrusion Detection Systems (NIDS) predominantly rely on signature-based and supervised learning approaches that require large volumes of labeled attack data. However, generating such labeled data is costly, time-consuming, and often impractical, especially in the presence of class imbalance and zero-day attacks. To address these limitations, this paper proposes MVNIDS, a Multiview-based Network Intrusion Detection System employing a self-supervised learning paradigm. The proposed method constructs three complementary views from raw packet capture data, namely, Network View, Flow View, and Image View, each capturing distinct protocol, temporal, and structural characteristics of network traffic. Independent autoencoder models are trained on benign samples for each view, and their reconstruction errors are fused through a majority-voting mechanism to automatically generate “Attack” and “Benign” pseudo-labels. These labels are subsequently used to train a binary classifier for final intrusion detection. Experimental evaluation on the CICIDS2018 dataset, focusing on FTP BruteForce and UDP DoS attacks, demonstrates that MVNIDS outperforms most view-specific and supervised baselines, achieving up to 98.3 % F1-score and 98.5 % accuracy. The multiview representation enhances detection robustness and enables effective identification of zero-day and variant attacks, highlighting MVNIDS as a scalable, computationally efficient, and generalizable framework for modern network security applications.