# Learning to Detect: A Data-driven Approach for Network Intrusion Detection

arXiv: https://arxiv.org/abs/2108.08394 · HTML: https://mlsanity.com/paper/2108.08394/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 21 references that are in the map.
- First posted on arXiv 18 Aug 2021.

## Builds on (most cited first, 4 of 4)

- [Benchmarking datasets for Anomaly-based Network Intrusion Detection: KDD CUP 99 alternatives](https://mlsanity.com/paper/1811.05372/) (2018)
- [Unified Host and Network Data Set](https://mlsanity.com/paper/1708.07518/) (2017)
- [A Transfer Learning Approach for Network Intrusion Detection](https://mlsanity.com/paper/1909.02352/) (2019)
- [LuNet: A Deep Neural Network for Network Intrusion Detection](https://mlsanity.com/paper/1909.10031/) (2019)

## Built on by (most cited first, 1 of 1)

- [Enhancing Trustworthiness in ML-Based Network Intrusion Detection with Uncertainty Quantification](https://mlsanity.com/paper/2310.10655/) (2023)

## Abstract (arXiv)

With massive data being generated daily and the ever-increasing interconnectivity of the world's Internet infrastructures, a machine learning based intrusion detection system (IDS) has become a vital component to protect our economic and national security. In this paper, we perform a comprehensive study on NSL-KDD, a network traffic dataset, by visualizing patterns and employing different learning-based models to detect cyber attacks. Unlike previous shallow learning and deep learning models that use the single learning model approach for intrusion detection, we adopt a hierarchy strategy, in which the intrusion and normal behavior are classified firstly, and then the specific types of attacks are classified. We demonstrate the advantage of the unsupervised representation learning model in binary intrusion detection tasks. Besides, we alleviate the data imbalance problem with SVM-SMOTE oversampling technique in 4-class classification and further demonstrate the effectiveness and the drawback of the oversampling mechanism with a deep neural network as a base model.