# A Hybrid Deep Learning Anomaly Detection Framework for Intrusion Detection

arXiv: https://arxiv.org/abs/2212.00966 · HTML: https://mlsanity.com/paper/2212.00966/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 20 references that are in the map.
- First posted on arXiv 2 Dec 2022.

## Builds on (most cited first, 4 of 4)

- [GANomaly: Semi-Supervised Anomaly Detection via Adversarial Training](https://mlsanity.com/paper/1805.06725/) (2018)
- [On the Nature and Types of Anomalies: A Review of Deviations in Data](https://mlsanity.com/paper/2007.15634/) (2020)
- [Federated Machine Learning for Intelligent IoT via Reconfigurable Intelligent Surface](https://mlsanity.com/paper/2004.05843/) (2020)
- [Federated TON_IoT Windows Datasets for Evaluating AI-based Security Applications](https://mlsanity.com/paper/2010.08522/) (2020)

## Built on by (most cited first, 5 of 5)

- [Multi-agent Reinforcement Learning-based Network Intrusion Detection System](https://mlsanity.com/paper/2407.05766/) (2024)
- [Robust Anomaly Detection in Network Traffic: Evaluating Machine Learning Models on CICIDS2017](https://mlsanity.com/paper/2506.19877/) (2025)
- [Few-shot Weakly-supervised Cybersecurity Anomaly Detection](https://mlsanity.com/paper/2304.07470/) (2023)
- [UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection](https://mlsanity.com/paper/2605.22621/) (2026)
- [ClouDens: Operational Context-Aware Anomaly Detection for Large-scale Cloud System Monitoring](https://mlsanity.com/paper/2607.18127/) (2026)

## Abstract (arXiv)

Cyber intrusion attacks that compromise the users' critical and sensitive data are escalating in volume and intensity, especially with the growing connections between our daily life and the Internet. The large volume and high complexity of such intrusion attacks have impeded the effectiveness of most traditional defence techniques. While at the same time, the remarkable performance of the machine learning methods, especially deep learning, in computer vision, had garnered research interests from the cyber security community to further enhance and automate intrusion detections. However, the expensive data labeling and limitation of anomalous data make it challenging to train an intrusion detector in a fully supervised manner. Therefore, intrusion detection based on unsupervised anomaly detection is an important feature too. In this paper, we propose a three-stage deep learning anomaly detection based network intrusion attack detection framework. The framework comprises an integration of unsupervised (K-means clustering), semi-supervised (GANomaly) and supervised learning (CNN) algorithms. We then evaluated and showed the performance of our implemented framework on three benchmark datasets: NSL-KDD, CIC-IDS2018, and TON_IoT.