# Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection

arXiv: https://arxiv.org/abs/1802.09089 · HTML: https://mlsanity.com/paper/1802.09089/

## Key facts

- Cited by 121 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Feb 2018.

## Built on by (most cited first, 30 of 121)

- [SSD: A Unified Framework for Self-Supervised Outlier Detection](https://mlsanity.com/paper/2103.12051/) (2021)
- [Learning Graph Structures with Transformer for Multivariate Time Series Anomaly Detection in IoT](https://mlsanity.com/paper/2104.03466/) (2021)
- [Large Language Models for Cyber Security: A Systematic Literature Review](https://mlsanity.com/paper/2405.04760/) (2024)
- [Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems](https://mlsanity.com/paper/2401.05778/) (2024)
- [The Threat of Offensive AI to Organizations](https://mlsanity.com/paper/2106.15764/) (2021)
- [Federated Learning for Malware Detection in IoT Devices](https://mlsanity.com/paper/2104.09994/) (2021)
- [The Role of Machine Learning in Cybersecurity](https://mlsanity.com/paper/2206.09707/) (2022)
- [Realtime Robust Malicious Traffic Detection via Frequency Domain Analysis](https://mlsanity.com/paper/2106.14707/) (2021)
- [DeepAID: Interpreting and Improving Deep Learning-based Anomaly Detection in Security Applications](https://mlsanity.com/paper/2109.11495/) (2021)
- [Adaptive Memory Networks with Self-supervised Learning for Unsupervised Anomaly Detection](https://mlsanity.com/paper/2201.00464/) (2022)
- [netFound: Principled Design for Network Foundation Models](https://mlsanity.com/paper/2310.17025/) (2023)
- [SoK: The Impact of Unlabelled Data in Cyberthreat Detection](https://mlsanity.com/paper/2205.08944/) (2022)
- [Federated Intrusion Detection for IoT with Heterogeneous Cohort Privacy](https://mlsanity.com/paper/2101.09878/) (2021)
- [SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection](https://mlsanity.com/paper/2305.00550/) (2023)
- [TANTRA: Timing-Based Adversarial Network Traffic Reshaping Attack](https://mlsanity.com/paper/2103.06297/) (2021)
- [MemStream: Memory-Based Streaming Anomaly Detection](https://mlsanity.com/paper/2106.03837/) (2021)
- [AnoShift: A Distribution Shift Benchmark for Unsupervised Anomaly Detection](https://mlsanity.com/paper/2206.15476/) (2022)
- [METER: A Dynamic Concept Adaptation Framework for Online Anomaly Detection](https://mlsanity.com/paper/2312.16831/) (2023)
- [PCAP-Backdoor: Backdoor Poisoning Generator for Network Traffic in CPS/IoT Environments](https://mlsanity.com/paper/2501.15563/) (2025)
- [Ensemble neuroevolution based approach for multivariate time series anomaly detection](https://mlsanity.com/paper/2108.03585/) (2021)
- [Adversarial Machine Learning In Network Intrusion Detection Domain: A Systematic Review](https://mlsanity.com/paper/2112.03315/) (2021)
- [Model Selection of Anomaly Detectors in the Absence of Labeled Validation Data](https://mlsanity.com/paper/2310.10461/) (2023)
- [DI-NIDS: Domain Invariant Network Intrusion Detection System](https://mlsanity.com/paper/2210.08252/) (2022)
- [TAD: Transfer Learning-based Multi-Adversarial Detection of Evasion Attacks against Network Intrusion Detection Systems](https://mlsanity.com/paper/2210.15700/) (2022)
- [Semi-WTC: A Practical Semi-supervised Framework for Attack Categorization through Weight-Task Consistency](https://mlsanity.com/paper/2205.09669/) (2022)
- [Quantized Training of Gradient Boosting Decision Trees](https://mlsanity.com/paper/2207.09682/) (2022)
- [FedDef: Defense Against Gradient Leakage in Federated Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2210.04052/) (2022)
- [Exploring Edge TPU for Network Intrusion Detection in IoT](https://mlsanity.com/paper/2103.16295/) (2021)
- [An Adaptable Deep Learning-Based Intrusion Detection System to Zero-Day Attacks](https://mlsanity.com/paper/2108.09199/) (2021)
- [Brain-on-Switch: Towards Advanced Intelligent Network Data Plane via NN-Driven Traffic Analysis at Line-Speed](https://mlsanity.com/paper/2403.11090/) (2024)

## Abstract (arXiv)

Neural networks have become an increasingly popular solution for network intrusion detection systems (NIDS). Their capability of learning complex patterns and behaviors make them a suitable solution for differentiating between normal traffic and network attacks. However, a drawback of neural networks is the amount of resources needed to train them. Many network gateways and routers devices, which could potentially host an NIDS, simply do not have the memory or processing power to train and sometimes even execute such models. More importantly, the existing neural network solutions are trained in a supervised manner. Meaning that an expert must label the network traffic and update the model manually from time to time. In this paper, we present Kitsune: a plug and play NIDS which can learn to detect attacks on the local network, without supervision, and in an efficient online manner. Kitsune's core algorithm (KitNET) uses an ensemble of neural networks called autoencoders to collectively differentiate between normal and abnormal traffic patterns. KitNET is supported by a feature extraction framework which efficiently tracks the patterns of every network channel. Our evaluations show that Kitsune can detect various attacks with a performance comparable to offline anomaly detectors, even on a Raspberry PI. This demonstrates that Kitsune can be a practical and economic NIDS.