{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,31]],"date-time":"2026-03-31T14:32:42Z","timestamp":1774967562492,"version":"3.50.1"},"reference-count":54,"publisher":"MDPI AG","issue":"13","license":[{"start":{"date-parts":[[2021,6,23]],"date-time":"2021-06-23T00:00:00Z","timestamp":1624406400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Korea government (MSIT)","award":["2020-0-00952"],"award-info":[{"award-number":["2020-0-00952"]}]},{"name":"Korea government (MSIT)","award":["2019-0-00421"],"award-info":[{"award-number":["2019-0-00421"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>As network attacks are constantly and dramatically evolving, demonstrating new patterns, intelligent Network Intrusion Detection Systems (NIDS), using deep-learning techniques, have been actively studied to tackle these problems. Recently, various autoencoders have been used for NIDS in order to accurately and promptly detect unknown types of attacks (i.e., zero-day attacks) and also alleviate the burden of the laborious labeling task. Although the autoencoders are effective in detecting unknown types of attacks, it takes tremendous time and effort to find the optimal model architecture and hyperparameter settings of the autoencoders that result in the best detection performance. This can be an obstacle that hinders practical applications of autoencoder-based NIDS. To address this challenge, we rigorously study autoencoders using the benchmark datasets, NSL-KDD, IoTID20, and N-BaIoT. We evaluate multiple combinations of different model structures and latent sizes, using a simple autoencoder model. The results indicate that the latent size of an autoencoder model can have a significant impact on the IDS performance.<\/jats:p>","DOI":"10.3390\/s21134294","type":"journal-article","created":{"date-parts":[[2021,6,23]],"date-time":"2021-06-23T11:28:41Z","timestamp":1624447721000},"page":"4294","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":118,"title":["Analysis of Autoencoders for Network Intrusion Detection"],"prefix":"10.3390","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6497-2659","authenticated-orcid":false,"given":"Youngrok","family":"Song","sequence":"first","affiliation":[{"name":"Department of AI, Sungkyunkwan University, Suwon 16419, Gyeonggi-do, Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2265-4518","authenticated-orcid":false,"given":"Sangwon","family":"Hyun","sequence":"additional","affiliation":[{"name":"Department of Computer Engineering, Myongji University, Yongin 17058, Gyeonggi-do, Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6329-8439","authenticated-orcid":false,"given":"Yun-Gyung","family":"Cheong","sequence":"additional","affiliation":[{"name":"Department of AI, Sungkyunkwan University, Suwon 16419, Gyeonggi-do, Korea"}]}],"member":"1968","published-online":{"date-parts":[[2021,6,23]]},"reference":[{"key":"ref_1","unstructured":"Barreno, M.A. (2002). The Future of Cryptography under Quantum Computers. [Undergraduate Thesis, Dartmouth College]."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Chen, L., Jordan, S., Liu, Y.K., Moody, D., Peralta, R., Perlner, R., and Smith-Tone, D. (2016). Report on Post-Quantum Cryptography.","DOI":"10.6028\/NIST.IR.8105"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"188","DOI":"10.1038\/nature23461","article-title":"Post-quantum cryptography","volume":"549","author":"Bernstein","year":"2017","journal-title":"Nature"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Lizama-Perez, L.A., and L\u00f3pez R, J.M. (2021). Non-Invertible Public Key Certificates. Entropy, 23.","DOI":"10.3390\/e23020226"},{"key":"ref_5","unstructured":"(2021, June 21). Cyphort. Cyphort Data Sheet. Available online: http:\/\/go.cyphort.com\/rs\/181-NTN-682\/images\/CYPHORT_DataSheet.pdf."},{"key":"ref_6","unstructured":"(2021, June 21). RSA. RSA Netwitness Logs and Packets. Available online: https:\/\/www.rsa.com\/content\/dam\/en\/data-sheet\/rsa-netwitness-logs-and-packets.pdf."},{"key":"ref_7","unstructured":"Sapre, S., Ahmadi, P., and Islam, K.R. (2019). A Robust Comparison of the KDDCup99 and NSL-KDD IoT Network Intrusion Detection Datasets Through Various Machine Learning Algorithms. arXiv."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"41","DOI":"10.1109\/MC.2018.2888764","article-title":"KDD Cup 99 Data Sets: A Perspective on the Role of Data Sets in Network Intrusion Detection Research","volume":"52","author":"Siddique","year":"2019","journal-title":"Computer"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"231","DOI":"10.1016\/j.cose.2014.06.006","article-title":"Selection of candidate support vectors in incremental SVM for network intrusion detection","volume":"45","author":"Chitrakar","year":"2014","journal-title":"Comput. Secur."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"2986","DOI":"10.1109\/TC.2016.2519914","article-title":"Building an intrusion detection system using a filter-based feature selection algorithm","volume":"65","author":"Ambusaidi","year":"2016","journal-title":"IEEE Trans. Comput."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Sahu, S., and Mehtre, B.M. (2015, January 10\u201313). Network intrusion detection system using J48 Decision Tree. Proceedings of the 2015 International Conference on Advances in Computing, Communications and Informatics (ICACCI), Kerala, India.","DOI":"10.1109\/ICACCI.2015.7275914"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"e4062","DOI":"10.1002\/ett.4062","article-title":"Intelligent intrusion detection system in smart grid using computational intelligence and machine learning","volume":"32","author":"Khan","year":"2020","journal-title":"Trans. Emerg. Telecommun. Technol."},{"key":"ref_13","unstructured":"Hettich, S. (2021, June 21). KDD Cup 1999 Data. Available online: http:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/kddcup99.html."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A. (2009, January 8\u201310). A detailed analysis of the KDD CUP 99 data set. Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, ON, Canada.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Salama, M.A., Eid, H.F., Ramadan, R.A., Darwish, A., and Hassanien, A.E. (2011). Hybrid intelligent intrusion detection scheme. Soft Computing in Industrial Applications, Springer.","DOI":"10.1007\/978-3-642-20505-7_26"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Kim, J., Kim, J., Thu, H.L.T., and Kim, H. (2016, January 15\u201317). Long short term memory recurrent neural network classifier for intrusion detection. Proceedings of the 2016 International Conference on Platform Technology and Service (PlatCon), Jeju, Korea.","DOI":"10.1109\/PlatCon.2016.7456805"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Alom, M.Z., Bontupalli, V., and Taha, T. (2015, January 16\u201319). Intrusion detection using deep belief networks. Proceedings of the 2015 IEEE National Aerospace and Electronics Conference (NAECON), Piscataway, NJ, USA.","DOI":"10.1109\/NAECON.2015.7443094"},{"key":"ref_18","unstructured":"Kuypers, M.A., Maillart, T., and Pat\u00e9-Cornell, E. (2016, July 30). An Empirical Analysis of Cyber Security Incidents at a Large Organization. Department of Management Science and Engineering, Stanford University, School of Information, UC Berkeley. Available online: http:\/\/fsi.stanford.edu\/sites\/default\/files\/kuypersweis_v7.pdf."},{"key":"ref_19","unstructured":"Petersen, R. (2015). Data Mining for Network Intrusion Detection: A Comparison of Data Mining Algorithms and an Analysis of Relevant Features for Detecting Cyber-Attacks. [Undergraduate Thesis, Mid Sweden University]."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1016\/j.cose.2008.08.003","article-title":"Anomaly-based network intrusion detection: Techniques, systems and challenges","volume":"28","year":"2009","journal-title":"Comput. Secur."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Kaur, H., Singh, G., and Minhas, J. (2013). A review of machine learning based anomaly detection techniques. arXiv.","DOI":"10.7753\/IJCATR0202.1020"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"1153","DOI":"10.1109\/COMST.2015.2494502","article-title":"A survey of data mining and machine learning methods for cyber security intrusion detection","volume":"18","author":"Buczak","year":"2015","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Song, J., Takakura, H., Okabe, Y., and Kwon, Y. (2011). Correlation analysis between honeypot data and IDS alerts using one-class SVM. Intrusion Detection Systems, InTech.","DOI":"10.5772\/13951"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Ishida, M., Takakura, H., and Okabe, Y. (2011, January 18\u201321). High-performance intrusion detection using optigrid clustering and grid-based labelling. Proceedings of the 2011 IEEE\/IPSJ International Symposium on Applications and the Internet, Munich, Bavaria, Germany.","DOI":"10.1109\/SAINT.2011.12"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Mirsky, Y., Doitshman, T., Elovici, Y., and Shabtai, A. (2018, January 18\u201321). Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection. Proceedings of the 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, CA, USA.","DOI":"10.14722\/ndss.2018.23204"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Aygun, R.C., and Yavuz, A.G. (2017, January 26\u201328). Network anomaly detection with stochastically improved autoencoder based models. Proceedings of the 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing (CSCloud), New York, NY, USA.","DOI":"10.1109\/CSCloud.2017.39"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"108346","DOI":"10.1109\/ACCESS.2020.3001350","article-title":"Anomaly-Based Intrusion Detection From Network Flow Features Using Variational Autoencoder","volume":"8","author":"Zavrak","year":"2020","journal-title":"IEEE Access"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., and Ghogho, M. (2016, January 26\u201329). Deep learning approach for network intrusion detection in software defined networking. Proceedings of the International Conference on Wireless Networks and Mobile Communications (WINCOM), Fez, Morocco.","DOI":"10.1109\/WINCOM.2016.7777224"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"130","DOI":"10.1016\/j.future.2021.03.024","article-title":"Multi-dimensional feature fusion and stacking ensemble mechanism for network intrusion detection","volume":"122","author":"Zhang","year":"2021","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Yong, B., Wei, W., Li, K.C., Shen, J., Zhou, Q., Wozniak, M., Po\u0142ap, D., and Dama\u0161evi\u010dius, R. (2020). Ensemble machine learning approaches for webshell detection in Internet of things environments. Trans. Emerg. Telecommun. Technol. Wiley Online Libr., e4085.","DOI":"10.1002\/ett.4085"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Hemalatha, J., Roseline, S.A., Geetha, S., Kadry, S., and Dama\u0161evi\u010dius, R. (2021). An Efficient DenseNet-Based Deep Learning Model for Malware Detection. Entropy, 23.","DOI":"10.3390\/e23030344"},{"key":"ref_32","first-page":"205","article-title":"A Hybrid Malicious Code Detection Method based on Deep Learning","volume":"9","author":"Li","year":"2015","journal-title":"Int. J. Softw. Eng. Appl."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Tao, X., Kong, D., Wei, Y., and Wang, Y. (2016). A Big Network Traffic Data Fusion Approach Based on Fisher and Deep Auto-Encoder. Information, 7.","DOI":"10.3390\/info7020020"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Javaid, A., Niyaz, Q., Sun, W., and Alam, M. (2015, January 3\u20135). A Deep Learning Approach for Network Intrusion Detection System. Proceedings of the 9th EAI International Conference on Bio-inspired Information and Communications Technologies (Formerly BIONETICS), New York City, NY, USA.","DOI":"10.4108\/eai.3-12-2015.2262516"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"41","DOI":"10.1109\/TETCI.2017.2772792","article-title":"A deep learning approach to network intrusion detection","volume":"2","author":"Shone","year":"2018","journal-title":"IEEE Trans. Emerg. Top. Comput. Intell."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"52843","DOI":"10.1109\/ACCESS.2018.2869577","article-title":"Deep Learning Approach Combining Sparse Autoencoder With SVM for Network Intrusion Detection","volume":"6","author":"Lasheng","year":"2018","journal-title":"IEEE Access"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Madani, P., and Vlajic, N. (2018, January 10\u201311). Robustness of deep autoencoder in intrusion detection under adversarial contamination. Proceedings of the 5th Annual Symposium and Bootcamp on Hot Topics in the Science of Security, Raleigh, NC, USA.","DOI":"10.1145\/3190619.3190637"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Yu, Y., Long, J., and Cai, Z. (2017). Network intrusion detection through stacking dilated convolutional autoencoders. Secur. Commun. Netw.","DOI":"10.1155\/2017\/4184196"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Thing, V.L. (2017, January 19\u201322). IEEE 802.11 network anomaly detection and attack classification: A deep learning approach. Proceedings of the 2017 IEEE Wireless Communications and Networking Conference (WCNC), San Francisco, CA, USA.","DOI":"10.1109\/WCNC.2017.7925567"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Zhang, B., Yu, Y., and Li, J. (2018, January 20\u201324). Network Intrusion Detection Based on Stacked Sparse Autoencoder and Binary Tree Ensemble Method. Proceedings of the 2018 IEEE International Conference on Communications Workshops (ICC Workshops), Kansas City, MO, USA.","DOI":"10.1109\/ICCW.2018.8403759"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Dutta, V., Chora\u015b, M., Pawlicki, M., and Kozik, R. (2020). A Deep Learning Ensemble for Network Anomaly and Cyber-Attack Detection. Sensors, 20.","DOI":"10.3390\/s20164583"},{"key":"ref_42","unstructured":"(2021, March 09). Agustin Parmisano and Sebastian Garcia and Maria Jose Erquiaga. A Labeled Dataset with Malicious and Benign IoT Network Traffic. Available online: https:\/\/www.stratosphereips.org\/datasets-iot23."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Damasevicius, R., Venckauskas, A., Grigaliunas, S., Toldinas, J., Morkevicius, N., Aleliunas, T., and Smuikys, P. (2020). LITNET-2020: An annotated real-world network flow dataset for network intrusion detection. Electronics, 9.","DOI":"10.3390\/electronics9050800"},{"key":"ref_44","unstructured":"(2021, March 09). NetML-2020 Dataset. Available online: https:\/\/eval.ai\/web\/challenges\/challenge-page\/526\/overview."},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Mart\u00edn, M.L., Carro, B., S\u00e1nchez-Esguevillas, A., and Lloret, J. (2017). Conditional Variational Autoencoder for Prediction and Feature Recovery Applied to Intrusion Detection in IoT. Sensors, 17.","DOI":"10.3390\/s17091967"},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1109\/MPRV.2018.03367731","article-title":"N-BaIoT\u2014Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders","volume":"17","author":"Meidan","year":"2018","journal-title":"IEEE Pervasive Comput."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Shahid, M.R., Blanc, G., Zhang, Z., and Debar, H. (2019, January 26\u201328). Anomalous Communications Detection in IoT Networks Using Sparse Autoencoders. Proceedings of the 2019 IEEE 18th International Symposium on Network Computing and Applications (NCA), Cambridge, MA, USA.","DOI":"10.1109\/NCA.2019.8935007"},{"key":"ref_48","unstructured":"Pa, Y.M.P., Suzuki, S., Yoshioka, K., Matsumoto, T., Kasama, T., and Rossow, C. (2015, January 10\u201311). IoTPOT: Analysing the rise of IoT compromises. Proceedings of the 9th USENIX Workshop on Offensive Technologies (WOOT), Washington, DC, USA."},{"key":"ref_49","unstructured":"Goutte, C., and Zhu, X. (2020). A Scheme for Generating a Dataset for Anomalous Activity Detection in IoT Networks. Advances in Artificial Intelligence, Springer International Publishing."},{"key":"ref_50","doi-asserted-by":"crossref","unstructured":"Yang, Y., Zheng, K., Wu, C., and Yang, Y. (2019). Improving the Classification Effectiveness of Intrusion Detection by Using Improved Conditional Variational AutoEncoder and Deep Neural Network. Sensors, 19.","DOI":"10.3390\/s19112528"},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Liu, H., and Lang, B. (2019). Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey. Appl. Sci., 9.","DOI":"10.3390\/app9204396"},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Boughorbel, S., Jarray, F., and El-Anbari, M. (2017). Optimal classifier for imbalanced data using Matthews Correlation Coefficient metric. PLoS ONE, 12.","DOI":"10.1371\/journal.pone.0177678"},{"key":"ref_53","unstructured":"Kingma, D.P., and Ba, J. (2015, January 7\u20139). Adam: A Method for Stochastic Optimization. Proceedings of the 3rd International Conference on Learning Representations (ICLR), San Diego, CA, USA."},{"key":"ref_54","doi-asserted-by":"crossref","first-page":"e4327","DOI":"10.1002\/dac.4327","article-title":"A lightweight portable intrusion detection communication system for auditing applications","volume":"33","author":"Nykvist","year":"2020","journal-title":"Int. J. Commun. Syst."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/13\/4294\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T06:22:17Z","timestamp":1760163737000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/13\/4294"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,6,23]]},"references-count":54,"journal-issue":{"issue":"13","published-online":{"date-parts":[[2021,7]]}},"alternative-id":["s21134294"],"URL":"https:\/\/doi.org\/10.3390\/s21134294","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,6,23]]}}}