# Stacking an autoencoder for feature selection of zero-day threats

arXiv: https://arxiv.org/abs/2311.00304 · HTML: https://mlsanity.com/paper/2311.00304/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 28 references that are in the map.
- First posted on arXiv 1 Nov 2023.

## Builds on (most cited first, 3 of 3)

- [From Zero-Shot Machine Learning to Zero-Day Attack Detection](https://mlsanity.com/paper/2109.14868/) (2021)
- [Zero-Day Threats Detection for Critical Infrastructures](https://mlsanity.com/paper/2306.06366/) (2023)
- [Arbitrary Discrete Sequence Anomaly Detection with Zero Boundary LSTM](https://mlsanity.com/paper/1803.02395/) (2018)

## Abstract (arXiv)

Zero-day attack detection plays a critical role in mitigating risks, protecting assets, and staying ahead in the evolving threat landscape. This study explores the application of stacked autoencoder (SAE), a type of artificial neural network, for feature selection and zero-day threat classification using a Long Short-Term Memory (LSTM) scheme. The process involves preprocessing the UGRansome dataset and training an unsupervised SAE for feature extraction. Finetuning with supervised learning is then performed to enhance the discriminative capabilities of this model. The learned weights and activations of the autoencoder are analyzed to identify the most important features for discriminating between zero-day threats and normal system behavior. These selected features form a reduced feature set that enables accurate classification. The results indicate that the SAE-LSTM performs well across all three attack categories by showcasing high precision, recall, and F1 score values, emphasizing the model's strong predictive capabilities in identifying various types of zero-day attacks. Additionally, the balanced average scores of the SAE-LSTM suggest that the model generalizes effectively and consistently across different attack categories.