Explainable Self-Supervised Autoencoder Framework for Network Traffic Anomaly Detection Using the UNSW-NB15 Dataset

Abstract

: The current network infrastructure is becoming more susceptible to advanced cyber-attacks that are evolving at a faster rate compared to the traditional intrusion detection systems. Traditional supervised methods of learning are commonly based on huge labeled data sets, which may be impossible to obtain, unequal or obsolete in dynamic settings. To overcome these difficulties, this paper will suggest an Explainable Self-Supervised Autoencoder Framework (SS-AE) to detect network traffic anomalies using the UNSW-NB15 dataset. The structure uses self-supervised reconstruction learning in capturing the inherent patterns of normal traffic without the use of labeled attack data. Deviations to learned behavior are observed as anomalies, which can be identified at early stages of an unknown attack or a zero-day attack, which is determined by reconstruction error thresholds. The model combines an explainability module which measures errors in reconstruction by features enabling analysts to understand the reasons behind perceived anomalies. A substantial amount of experiments has shown that the proposed SS-AE has a high level of detection accuracy with AUC-ROC of 0.8427, PR-AUC of 0.9246, precision of 99.76, and F1-score of 0.5613. These findings are superior to the traditional unsupervised algorithms like Isolation Forest and One-Class SVM and are computationally efficient on standard CPU machines. The visualization dashboard developed using Streamlit also increases interpretability and real-time usability. This paper arrives at the conclusion that self-supervised learning and explainable AI are an effective and transparent solution to implementing in the real world when it comes to cybersecurity. The suggested SS-AE model suggests a scalable, interpretable and resource efficient platform upon which next generation network intrusion detectors can be developed.