Unsupervised Deep Autoencoder for Zero-Day Anomaly Detection in Network Traffic

Abstract

Zero-day attacks are among the most serious problems in today’s network security because these attacks exploit unknown vulnerabilities and are able to evade classical signature-based intrusion detection systems. Recently, great success has been achieved in the application of deep learning, especially unsupervised deep autoencoders, in detecting anomalous patterns in the traffic data without relying on labeled attack data. The autoencoders are able to learn the representation of normal traffic and detect anomalies based on reconstruction errors. This review presents a thorough examination of the existing unsupervised deep autoencoder-based methods and their combination models proposed for zero-day anomaly detection in network traffic. The relevant work is critically analyzed from the perspective of model design, datasets, validation practices, and the ability to handle unknown anomalies. The recent advancements in the field with the evolution of convolutional, variational, temporal, and attention-driven autoencoders are also presented. Although these models demonstrated excellent results, the problem of high false positives, unstandardized zero-day validation, lack of interpretability, and practical deployability limitations exists. Finally, the discussion ends with addressing future directions toward an adaptive and interpretable autoencoder-based intrusion detection system.