{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,10]],"date-time":"2026-06-10T16:43:15Z","timestamp":1781109795401,"version":"3.54.1"},"reference-count":59,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2019,6,2]],"date-time":"2019-06-02T00:00:00Z","timestamp":1559433600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Key R&amp;D Program of China","award":["2017YFB0802703"],"award-info":[{"award-number":["2017YFB0802703"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61602052"],"award-info":[{"award-number":["61602052"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Intrusion detection systems play an important role in preventing security threats and protecting networks from attacks. However, with the emergence of unknown attacks and imbalanced samples, traditional machine learning methods suffer from lower detection rates and higher false positive rates. We propose a novel intrusion detection model that combines an improved conditional variational AutoEncoder (ICVAE) with a deep neural network (DNN), namely ICVAE-DNN. ICVAE is used to learn and explore potential sparse representations between network data features and classes. The trained ICVAE decoder generates new attack samples according to the specified intrusion categories to balance the training data and increase the diversity of training samples, thereby improving the detection rate of the imbalanced attacks. The trained ICVAE encoder is not only used to automatically reduce data dimension, but also to initialize the weight of DNN hidden layers, so that DNN can easily achieve global optimization through back propagation and fine tuning. The NSL-KDD and UNSW-NB15 datasets are used to evaluate the performance of the ICVAE-DNN. The ICVAE-DNN is superior to the three well-known oversampling methods in data augmentation. Moreover, the ICVAE-DNN outperforms six well-known models in detection performance, and is more effective in detecting minority attacks and unknown attacks. In addition, the ICVAE-DNN also shows better overall accuracy, detection rate and false positive rate than the nine state-of-the-art intrusion detection methods.<\/jats:p>","DOI":"10.3390\/s19112528","type":"journal-article","created":{"date-parts":[[2019,6,3]],"date-time":"2019-06-03T02:08:40Z","timestamp":1559527720000},"page":"2528","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":237,"title":["Improving the Classification Effectiveness of Intrusion Detection by Using Improved Conditional Variational AutoEncoder and Deep Neural Network"],"prefix":"10.3390","volume":"19","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9993-7757","authenticated-orcid":false,"given":"Yanqing","family":"Yang","sequence":"first","affiliation":[{"name":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China"},{"name":"College of Information Science and Engineering, Xinjiang University, Urumqi 830046, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1160-5596","authenticated-orcid":false,"given":"Kangfeng","family":"Zheng","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5082-2422","authenticated-orcid":false,"given":"Chunhua","family":"Wu","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yixian","family":"Yang","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China"},{"name":"Guizhou Provincial Key Laboratory of Public Big Data, Guizhou University, Guiyang 550025, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2019,6,2]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"25359","DOI":"10.1109\/ACCESS.2019.2899831","article-title":"A Sanitization Approach to Secure Shared Data in an IoT Environment","volume":"7","author":"Lin","year":"2019","journal-title":"IEEE Access"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"31711","DOI":"10.1109\/ACCESS.2019.2903723","article-title":"Intrusion Detection for IoT Based on Improved Genetic Algorithm and Deep Belief Network","volume":"7","author":"Zhang","year":"2019","journal-title":"IEEE Access"},{"key":"ref_3","unstructured":"(2019, May 14). Background to IoT Security. Available online: https:\/\/safenet.gemalto.com\/iot-2018\/iot-security."},{"key":"ref_4","unstructured":"(2019, May 14). SecurityWeek. Available online: https:\/\/www.securityweek.com\/top-dutch-banks-hit-cyber-attacks."},{"key":"ref_5","unstructured":"(2019, May 14). Winter Olympics Hit by Cyber-Attack. Available online: https:\/\/www.bbc.com\/news\/technology-43030673."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"20255","DOI":"10.1109\/ACCESS.2018.2820092","article-title":"A new intrusion detection system based on fast learning network and particle swarm optimization","volume":"6","author":"Ali","year":"2018","journal-title":"IEEE Access"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"152","DOI":"10.1016\/j.jocs.2017.03.006","article-title":"Anomaly-based intrusion detection system through feature selection analysis and building hybrid efficient model","volume":"25","author":"Aljawarneh","year":"2018","journal-title":"J. Comput. Sci."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"303","DOI":"10.1016\/j.future.2017.01.029","article-title":"A novel statistical technique for intrusion detection systems","volume":"79","author":"Kabir","year":"2018","journal-title":"Fut. Gener. Comput. Syst."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"36","DOI":"10.1016\/j.eswa.2018.04.038","article-title":"An anomaly-based intrusion detection system in presence of benign outliers with visualization capabilities","volume":"108","author":"Karami","year":"2018","journal-title":"Expert Syst. Appl."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Moustafa, N., Creech, G., and Slay, J. (2018). Anomaly Detection System Using Beta Mixture Models and Outlier Detection. Progress in Computing, Analytics and Networking, Springer.","DOI":"10.1007\/978-981-10-7871-2_13"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"223","DOI":"10.1016\/j.neucom.2018.05.027","article-title":"Ramp loss one-class support vector machine; A robust and effective approach to anomaly detection problems","volume":"310","author":"Tian","year":"2018","journal-title":"Neurocomputing"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"304","DOI":"10.1016\/j.cose.2018.04.010","article-title":"Intrusion detection system for wireless mesh network using multiple support vector machine classifiers with genetic-algorithm-based feature selection","volume":"77","author":"Vijayanand","year":"2018","journal-title":"Comput. Secur."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"887","DOI":"10.1080\/0952813X.2018.1509379","article-title":"I-AHSDT: Intrusion detection using adaptive dynamic directive operative fractional lion clustering and hyperbolic secant-based decision tree classifier","volume":"30","author":"Ganeshan","year":"2018","journal-title":"J. Exp. Theor. Artif. Intell."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"1101","DOI":"10.3233\/IDA-173493","article-title":"Host-based misuse intrusion detection using PCA feature extraction and kNN classification algorithms","volume":"22","author":"Serpen","year":"2018","journal-title":"Intell. Data Anal."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"41","DOI":"10.1109\/TETCI.2017.2772792","article-title":"A deep learning approach to network intrusion detection","volume":"2","author":"Shone","year":"2018","journal-title":"IEEE Trans. Emerg. Top. Comput. Intell."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Lopez-Martin, M., Carro, B., Sanchez-Esguevillas, A., and Lloret, J. (2017). Conditional variational autoencoder for prediction and feature recovery applied to intrusion detection in iot. Sensors, 17.","DOI":"10.3390\/s17091967"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Malaiya, R.K., Kwon, D., Kim, J., Suh, S.C., Kim, H., and Kim, I. (2018, January 5\u20138). An Empirical Evaluation of Deep Learning for Network Anomaly Detection. Proceedings of the 2018 International Conference on Computing, Networking and Communications (ICNC), Maui, HI, USA.","DOI":"10.1109\/ICCNC.2018.8390278"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"159","DOI":"10.1089\/big.2018.0023","article-title":"Deep Learning Method for Denial of Service Attack Detection Based on Restricted Boltzmann Machine","volume":"6","author":"Imamverdiyev","year":"2018","journal-title":"Big Data"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"23","DOI":"10.1016\/j.jpdc.2018.04.005","article-title":"A malicious threat detection model for cloud assisted internet of things (CoT) based industrial control system (ICS) networks using deep belief network","volume":"120","author":"Huda","year":"2018","journal-title":"J. Parallel Distrib. Comput."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"111","DOI":"10.1016\/j.comnet.2018.07.025","article-title":"An evaluation of the performance of Restricted Boltzmann Machines as a model for anomaly network intrusion detection","volume":"144","author":"Novotny","year":"2018","journal-title":"Comput. Netw."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Yang, Y., Zheng, K., Wu, C., Niu, X., and Yang, Y. (2019). Building an Effective Intrusion Detection System Using the Modified Density Peak Clustering Algorithm and Deep Belief Networks. Appl. Sci., 9.","DOI":"10.3390\/app9020238"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Li, C., Wang, J., and Ye, X. (2018). Using a Recurrent Neural Network and Restricted Boltzmann Machines for Malicious Traffic Detection. NeuroQuantology, 16.","DOI":"10.14704\/nq.2018.16.5.1391"},{"key":"ref_23","first-page":"48","article-title":"A Survey of Random Forest Based Methods for Intrusion Detection Systems","volume":"51","author":"Resende","year":"2018","journal-title":"ACM Comput. Surv."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Yadahalli, S., and Nighot, M.K. (2017, January 17\u201319). Adaboost based parameterized methods for wireless sensor networks. Proceedings of the 2017 International Conference On Smart Technologies For Smart Nation (SmartTechCon), Bangalore, India.","DOI":"10.1109\/SmartTechCon.2017.8358590"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Roy, S.S., Krishna, P.V., and Yenduri, S. (2015, January 15\u201317). Analyzing Intrusion Detection System: An ensemble based stacking approach. Proceedings of the 2014 IEEE International Symposium on Signal Processing and Information Technology (ISSPIT), Noida, India.","DOI":"10.1109\/ISSPIT.2014.7300605"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"135","DOI":"10.1016\/j.cose.2016.11.004","article-title":"A survey of intrusion detection systems based on ensemble and hybrid classifiers","volume":"65","author":"Aburomman","year":"2017","journal-title":"Comput. Secur."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/TVCG.2017.2744878","article-title":"Visualizing dataflow graphs of deep learning models in TensorFlow","volume":"24","author":"Wongsuphasawat","year":"2018","journal-title":"IEEE Trans. Vis. Comput. Graph."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"38367","DOI":"10.1109\/ACCESS.2018.2854599","article-title":"Deep Learning-Based Intrusion Detection With Adversaries","volume":"6","author":"Wang","year":"2018","journal-title":"IEEE Access"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"35365","DOI":"10.1109\/ACCESS.2018.2836950","article-title":"Machine Learning and Deep Learning Methods for Cybersecurity","volume":"6","author":"Xin","year":"2018","journal-title":"IEEE Access"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"2986","DOI":"10.1109\/TC.2016.2519914","article-title":"Building an intrusion detection system using a filter-based feature selection algorithm","volume":"65","author":"Ambusaidi","year":"2016","journal-title":"IEEE Trans. Comput."},{"key":"ref_31","unstructured":"Kingma, D.P., and Welling, M. (2013). Auto-encoding variational bayes. arXiv."},{"key":"ref_32","unstructured":"Kingma, D.P., Mohamed, S., Rezende, D.J., and Welling, M. (2014, January 8\u201313). Semi-supervised learning with deep generative models. Proceedings of the 27th International Conference on Neural Information Processing Systems, Montreal, QC, Canada."},{"key":"ref_33","unstructured":"Sohn, K., Lee, H., and Yan, X. (2015, January 7\u201312). Learning structured output representation using deep conditional generative models. Proceedings of the 28th International Conference on Neural Information Processing Systems, Montreal, QC, Canada."},{"key":"ref_34","unstructured":"UNB (2019, January 20). NSL-KDD Dataset. Available online: https:\/\/www.unb.ca\/cic\/datasets\/nsl.html."},{"key":"ref_35","first-page":"446","article-title":"A study on NSL-KDD dataset for intrusion detection system based on classification algorithms","volume":"4","author":"Dhanabal","year":"2015","journal-title":"Int. J. Adv. Res. Comput. Commun. Eng."},{"key":"ref_36","unstructured":"ACCS (2019, January 20). UNSW-NB15 Dataset. Available online: https:\/\/www.unsw.adfa.edu.au\/unsw-canberra-cyber\/cybersecurity\/ADFA-NB15-Datasets\/."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1080\/19393555.2015.1125974","article-title":"The evaluation of Network Anomaly Detection Systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set","volume":"25","author":"Moustafa","year":"2016","journal-title":"Inf. Secur. J. A Glob. Perspect."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Kawachi, Y., Koizumi, Y., and Harada, N. (2018, January 15\u201320). Complementary Set Variational Autoencoder for Supervised Anomaly Detection. Proceedings of the 2018 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Calgary, AB, Canada.","DOI":"10.1109\/ICASSP.2018.8462181"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"33353","DOI":"10.1109\/ACCESS.2018.2848210","article-title":"Learning Sparse Representation With Variational Auto-Encoder for Anomaly Detection","volume":"6","author":"Sun","year":"2018","journal-title":"IEEE Access"},{"key":"ref_41","unstructured":"Chandy, S.E., Rasekh, A., Barker, Z.A., and Shafiee, M.E. (2018). Cyberattack Detection using Deep Generative Models with Variational Inference. arXiv."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Osada, G., Omote, K., and Nishide, T. (2017). Network Intrusion Detection Based on Semi-supervised Variational Auto-Encoder. European Symposium on Research in Computer Security, Springer.","DOI":"10.1007\/978-3-319-66399-9_19"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Thing, V.L. (2017, January 19\u201322). IEEE 802.11 network anomaly detection and attack classification: A deep learning approach. Proceedings of the 2017 IEEE Wireless Communications and Networking Conference (WCNC), San Francisco, CA, USA.","DOI":"10.1109\/WCNC.2017.7925567"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Ma, T., Wang, F., Cheng, J., Yu, Y., and Chen, X. (2016). A hybrid spectral clustering and deep neural network ensemble algorithm for intrusion detection in sensor networks. Sensors, 16.","DOI":"10.3390\/s16101701"},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Tang, T., Zaidi, S.A.R., McLernon, D., Mhamdi, L., and Ghogho, M. (2018, January 25\u201329). Deep Recurrent Neural Network for Intrusion Detection in SDN-based Networks. Proceedings of the 2018 4th IEEE Conference on Network Softwarization and Workshops (NetSoft), Montreal, QC, Canada.","DOI":"10.1109\/NETSOFT.2018.8460090"},{"key":"ref_46","first-page":"1","article-title":"Identification of malicious activities in industrial internet of things based on deep learning models","volume":"41","author":"Muna","year":"2018","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_47","unstructured":"Doersch, C. (2016). Tutorial on variational autoencoders. arXiv."},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Shen, L., Lin, Z., and Huang, Q. (2016, January 8\u201316). Relay backpropagation for effective learning of deep convolutional neural networks. Proceedings of the European Conference on Computer Vision, Amsterdam, The Netherlands.","DOI":"10.1007\/978-3-319-46478-7_29"},{"key":"ref_49","unstructured":"Kingma, D.P., and Ba, J. (2014). Adam: A method for stochastic optimization. arXiv."},{"key":"ref_50","unstructured":"Krizhevsky, A., and Hinton, G. (2010). Convolutional Deep Belief Networks on Cifar-10, Unpublished work."},{"key":"ref_51","unstructured":"KDDCup (2019, January 19). KDD Cup Dataset. Available online: http:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/kddcup99.html."},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A.A. (2009). A detailed analysis of the KDD CUP 99 data set. Computational Intelligence for Security and Defense Applications, IEEE.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref_53","first-page":"559","article-title":"Imbalanced-learn: A python toolbox to tackle the curse of imbalanced datasets in machine learning","volume":"18","author":"Nogueira","year":"2017","journal-title":"J. Mach. Learn. Res."},{"key":"ref_54","doi-asserted-by":"crossref","first-page":"321","DOI":"10.1613\/jair.953","article-title":"SMOTE: Synthetic minority over-sampling technique","volume":"16","author":"Chawla","year":"2002","journal-title":"J. Artif. Intell. Res."},{"key":"ref_55","unstructured":"He, H., Bai, Y., Garcia, E.A., and Li, S. (2008, January 1\u20138). ADASYN: Adaptive synthetic sampling approach for imbalanced learning. Proceedings of the 2008 IEEE International Joint Conference on Neural Networks (IEEE World Congress on Computational Intelligence), Hong Kong, China."},{"key":"ref_56","doi-asserted-by":"crossref","unstructured":"Javaid, A., Niyaz, Q., Sun, W., and Alam, M. (2016, January 3\u20135). A deep learning approach for network intrusion detection system. Proceedings of the 9th EAI International Conference on Bio-inspired Information and Communications Technologies (Formerly BIONETICS), New York, NY, USA.","DOI":"10.4108\/eai.3-12-2015.2262516"},{"key":"ref_57","doi-asserted-by":"crossref","unstructured":"Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., and Ghogho, M. (2016, January 26\u201329). Deep learning approach for network intrusion detection in software defined networking. Proceedings of the 2016 International Conference on Wireless Networks and Mobile Communications (WINCOM), Fez, Morocco.","DOI":"10.1109\/WINCOM.2016.7777224"},{"key":"ref_58","doi-asserted-by":"crossref","first-page":"21954","DOI":"10.1109\/ACCESS.2017.2762418","article-title":"A deep learning approach for intrusion detection using recurrent neural networks","volume":"5","author":"Yin","year":"2017","journal-title":"IEEE Access"},{"key":"ref_59","doi-asserted-by":"crossref","first-page":"2875","DOI":"10.3233\/JIFS-169230","article-title":"A multiclass cascade of artificial neural network for network intrusion detection","volume":"32","author":"Baig","year":"2017","journal-title":"J. Intell. Fuzzy Syst."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/19\/11\/2528\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T12:55:38Z","timestamp":1760187338000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/19\/11\/2528"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,6,2]]},"references-count":59,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2019,6]]}},"alternative-id":["s19112528"],"URL":"https:\/\/doi.org\/10.3390\/s19112528","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,6,2]]}}}