# DOC-NAD: A Hybrid Deep One-class Classifier for Network Anomaly Detection

arXiv: https://arxiv.org/abs/2212.07558 · HTML: https://mlsanity.com/paper/2212.07558/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 35 references that are in the map.
- First posted on arXiv 15 Dec 2022.

## Builds on (most cited first, 8 of 8)

- [Auto-Encoding Variational Bayes](https://mlsanity.com/paper/1312.6114/) (2013)
- [PyOD: A Python Toolbox for Scalable Outlier Detection](https://mlsanity.com/paper/1901.01588/) (2019)
- [One-Class Classification: Taxonomy of Study and Review of Techniques](https://mlsanity.com/paper/1312.0049/) (2013)
- [NetFlow Datasets for Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2011.09144/) (2020)
- [Towards a Standard Feature Set for Network Intrusion Detection System Datasets](https://mlsanity.com/paper/2101.11315/) (2021)
- [From Zero-Shot Machine Learning to Zero-Day Attack Detection](https://mlsanity.com/paper/2109.14868/) (2021)
- [Feature Extraction for Machine Learning-based Intrusion Detection in IoT Networks](https://mlsanity.com/paper/2108.12722/) (2021)
- [A Cyber Threat Intelligence Sharing Scheme based on Federated Learning for Network Intrusion Detection](https://mlsanity.com/paper/2111.02791/) (2021)

## Built on by (most cited first, 1 of 1)

- [MambaNetBurst: Direct Byte-level Network Traffic Classification without Tokenization or Pretraining](https://mlsanity.com/paper/2605.11034/) (2026)

## Abstract (arXiv)

Machine Learning (ML) approaches have been used to enhance the detection capabilities of Network Intrusion Detection Systems (NIDSs). Recent work has achieved near-perfect performance by following binary- and multi-class network anomaly detection tasks. Such systems depend on the availability of both (benign and malicious) network data classes during the training phase. However, attack data samples are often challenging to collect in most organisations due to security controls preventing the penetration of known malicious traffic to their networks. Therefore, this paper proposes a Deep One-Class (DOC) classifier for network intrusion detection by only training on benign network data samples. The novel one-class classification architecture consists of a histogram-based deep feed-forward classifier to extract useful network data features and use efficient outlier detection. The DOC classifier has been extensively evaluated using two benchmark NIDS datasets. The results demonstrate its superiority over current state-of-the-art one-class classifiers in terms of detection and false positive rates.