autoencodeR-based neural nEtwork for INtrusiOn DetectIon Systems with tRiplet loss function (RENOIR)

The repository contains code refered to the work:

Giuseppina Andresini, Annalisa Appice, Donato Malerba

Autoencoder-based Deep Metric Learning for Network Intrusion Detection

Please cite our work if you find it useful for your research and work.

@article{ANDRESINI2021,
title = {Autoencoder-based deep metric learning for network intrusion detection},
journal = {Information Sciences},
year = {2021},
issn = {0020-0255},
doi = {https://doi.org/10.1016/j.ins.2021.05.016},
url = {https://www.sciencedirect.com/science/article/pii/S002002552100462X},
author = {Giuseppina Andresini and Annalisa Appice and Donato Malerba},
keywords = {Network intrusion detection, Deep metric learning, Triplet network, Autoencoder}
}

Code requirements

The code relies on the following python2.6+ libs.

Packages need are:

Data

The datasets used for experiments are accessible from DATASETS. The repository contains the dataset after the preprocessing phase (folder: "numeric") Corresponding labels:

0: "Attacks"
1: "Normal"

Preprocessing phase is done mapping categorical feature and performing the Min Max scaler.

How to use

Repository contains scripts of all experiments included in the paper:

main.py : script to run RENOIR To run the code the command is main.py NameOfDataset (es CICIDS2017, AAGM or KDDCUP99)

Code contains models (autoencoder and classification) and datasets used for experiments in the work.

Replicate the experiments

To replicate experiments reported in the work, you can use models and datasets stored in homonym folders. Global variables are stored in RENOIR.conf file

    N_CLASSES = 2
    PREPROCESSING1 = 0  #if set to 1 code execute preprocessing phase on original date
    LOAD_AUTOENCODER_N = 1 #if 1 the autoencoder for normal items  is loaded from models folder
    LOAD_AUTOENCODER_A = 1 #if 1 the autoencoder for attacks items  is loaded from models folder
    LOAD_NN = 1  #if 1 the classifier is loaded from models folder
    VALIDATION_SPLIT #the percentage of validation set used to train models

Download datasets