{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,24]],"date-time":"2026-03-24T16:20:51Z","timestamp":1774369251401,"version":"3.50.1"},"reference-count":26,"publisher":"MDPI AG","issue":"4","license":[{"start":{"date-parts":[[2025,3,30]],"date-time":"2025-03-30T00:00:00Z","timestamp":1743292800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>In network intrusion detection systems (NIDS), conventional supervised learning approaches remain constrained by their reliance on labor-intensive labeled datasets, especially in evolving network ecosystems. Although unsupervised learning offers a viable alternative, current methodologies frequently face challenges in managing high-dimensional feature spaces and achieving optimal detection performance. To overcome these limitations, this study proposes a self-organizing maps-assisted variational autoencoder (SOVAE) framework. The SOVAE architecture employs feature correlation graphs combined with the Louvain community detection algorithm to conduct feature selection. The processed data\u2014characterized by reduced dimensionality and clustered structure\u2014is subsequently projected through self-organizing maps to generate cluster-based labels. These labels are further incorporated into the symmetric encoding-decoding reconstruction process of the VAE to enhance data reconstruction quality. Anomaly detection is implemented through quantitative assessment of reconstruction discrepancies and SOM deviations. Experimental results show that SOVAE achieves F1 scores of 0.983 (\u00b10.005) on UNSW-NB15 and 0.875 (\u00b10.008) on CICIDS2017, outperforming mainstream unsupervised baselines.<\/jats:p>","DOI":"10.3390\/sym17040520","type":"journal-article","created":{"date-parts":[[2025,3,31]],"date-time":"2025-03-31T05:21:04Z","timestamp":1743398464000},"page":"520","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["Self-Organizing Maps-Assisted Variational Autoencoder for Unsupervised Network Anomaly Detection"],"prefix":"10.3390","volume":"17","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-7052-8464","authenticated-orcid":false,"given":"Hailong","family":"Huang","sequence":"first","affiliation":[{"name":"College of Information Science and Engineering, Hunan Normal University, Changsha 410081, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2306-0156","authenticated-orcid":false,"given":"Jiahong","family":"Yang","sequence":"additional","affiliation":[{"name":"College of Information Science and Engineering, Hunan Normal University, Changsha 410081, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-3016-3613","authenticated-orcid":false,"given":"Hang","family":"Zeng","sequence":"additional","affiliation":[{"name":"College of Information Science and Engineering, Hunan Normal University, Changsha 410081, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-9926-5426","authenticated-orcid":false,"given":"Yaqin","family":"Wang","sequence":"additional","affiliation":[{"name":"College of Information Science and Engineering, Hunan Normal University, Changsha 410081, China"}]},{"given":"Liuming","family":"Xiao","sequence":"additional","affiliation":[{"name":"College of Information Science and Engineering, Hunan Normal University, Changsha 410081, China"}]}],"member":"1968","published-online":{"date-parts":[[2025,3,30]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Aslan, \u00d6., Aktu\u011f, S.S., Ozkan-Okay, M., Yilmaz, A.A., and Akin, E. (2023). A comprehensive review of cyber security vulnerabilities, threats, attacks, and solutions. Electronics, 12.","DOI":"10.3390\/electronics12061333"},{"key":"ref_2","unstructured":"Fuentes Garc\u00eda, N.M. (2024, December 01). Multivariate Statistical Network Monitoring for Network Security Based on Principal Component Analysis. Available online: https:\/\/digibug.ugr.es\/handle\/10481\/67941."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3439950","article-title":"Deep learning for anomaly detection: A review","volume":"54","author":"Pang","year":"2021","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Chalapathy, R., and Chawla, S. (2019). Deep learning for anomaly detection: A survey. arXiv.","DOI":"10.1145\/3394486.3406704"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1023\/B:AIRE.0000045502.10941.a9","article-title":"A survey of outlier detection methodologies","volume":"22","author":"Hodge","year":"2004","journal-title":"Artif. Intell. Rev."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Nguyen, Q.P., Lim, K.W., Divakaran, D.M., Low, K.H., and Chan, M.C. (2019, January 10\u201312). Gee: A gradient-based explainable variational autoencoder for network anomaly detection. Proceedings of the 2019 IEEE Conference on Communications and Network Security (CNS), Washington, DC, USA.","DOI":"10.1109\/CNS.2019.8802833"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_8","first-page":"108","article-title":"Toward generating a new intrusion detection dataset and intrusion traffic characterization","volume":"1","author":"Sharafaldin","year":"2018","journal-title":"ICISSp"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1156","DOI":"10.1109\/TIFS.2023.3331240","article-title":"TMG-GAN: Generative adversarial networks-based imbalanced learning for network intrusion detection","volume":"19","author":"Ding","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Hannan, A., Gruhl, C., and Sick, B. (2021, January 26\u201328). Anomaly based resilient network intrusion detection using inferential autoencoders. Proceedings of the 2021 IEEE International Conference on Cyber Security and Resilience (CSR), Rhodes, Greece.","DOI":"10.1109\/CSR51186.2021.9527980"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"911","DOI":"10.12785\/ijcds\/130172","article-title":"An unsupervised machine learning algorithms: Comprehensive review","volume":"13","author":"Naeem","year":"2023","journal-title":"Int. J. Comput. Digit. Syst."},{"key":"ref_12","unstructured":"Dinh, L., Sohl-Dickstein, J., and Bengio, S. (2016). Density estimation using real nvp. arXiv."},{"key":"ref_13","unstructured":"Zong, B., Song, Q., Min, M.R., Cheng, W., Lumezanu, C., Cho, D., and Chen, H. (May, January 30). Deep autoencoding gaussian mixture model for unsupervised anomaly detection. Proceedings of the International Conference on Learning Representations, Vancouver, BC, Canada."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"146","DOI":"10.26599\/TST.2019.9010051","article-title":"A Hybrid Unsupervised Clustering-Based Anomaly Detection Method","volume":"26","author":"Pu","year":"2021","journal-title":"Tsinghua Sci. Technol."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Chen, Y. (2023, January 23\u201325). Construction of a computer network fault analysis and intrusion detection system based on K-means clustering algorithm. Proceedings of the 2023 8th International Conference on Information Systems Engineering (ICISE), Dalian, China.","DOI":"10.1109\/ICISE60366.2023.00022"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Yang, D., and Hwang, M. (2022, January 26\u201329). Unsupervised and ensemble-based anomaly detection method for network security. Proceedings of the 2022 14th International Conference on Knowledge and Smart Technology (KST), Chon buri, Thailand.","DOI":"10.1109\/KST53302.2022.9729061"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Liao, J., Teo, S.G., Kundu, P.P., and Truong-Huu, T. (2021, January 26\u201328). ENAD: An ensemble framework for unsupervised network anomaly detection. Proceedings of the 2021 IEEE International Conference on Cyber Security and Resilience (CSR), Rhodes, Greece.","DOI":"10.1109\/CSR51186.2021.9527982"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Jiang, Y., Huang, T., Wang, J., and Kang, C. (2022, January 16\u201318). Anomaly detection of Argo data using variational autoencoder and K-means clustering. Proceedings of the 2022 IEEE 5th Advanced Information Management, Communicates, Electronic and Automation Control Conference (IMCEC), Chongqing, China.","DOI":"10.1109\/IMCEC55388.2022.10020148"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"1518","DOI":"10.1126\/science.1205438","article-title":"Detecting novel associations in large data sets","volume":"334","author":"Reshef","year":"2011","journal-title":"Science"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"917","DOI":"10.4236\/ojs.2023.136046","article-title":"Model-Free Feature Screening via Maximal Information Coefficient (MIC) for Ultrahigh-Dimensional Multiclass Classification","volume":"13","author":"Chen","year":"2023","journal-title":"Open J. Stat."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"P10008","DOI":"10.1088\/1742-5468\/2008\/10\/P10008","article-title":"Fast unfolding of communities in large networks","volume":"2008","author":"Blondel","year":"2008","journal-title":"J. Stat. Mech. Theory Exp."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"122529","DOI":"10.1016\/j.apenergy.2023.122529","article-title":"Statistical analysis of the regional air quality index of Yangtze River Delta based on complex network theory","volume":"357","author":"Liu","year":"2024","journal-title":"Appl. Energy"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"2289","DOI":"10.1038\/s41467-022-29411-4","article-title":"Implementing in-situ self-organizing maps with memristor crossbar arrays for data mining and optimization","volume":"13","author":"Wang","year":"2022","journal-title":"Nat. Commun."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"107086","DOI":"10.1016\/j.knosys.2021.107086","article-title":"Multi-scale self-organizing map assisted deep autoencoding Gaussian mixture model for unsupervised intrusion detection","volume":"224","author":"Chen","year":"2021","journal-title":"Knowl. Based Syst."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"743","DOI":"10.1016\/j.aej.2024.08.081","article-title":"Improving the performance of self-organizing map using reweighted zero-attracting method","volume":"106","author":"Hameed","year":"2024","journal-title":"Alex. Eng. J."},{"key":"ref_26","unstructured":"Arjovsky, M., Chintala, S., and Bottou, L. (2017, January 6\u201311). Wasserstein generative adversarial networks. Proceedings of the International Conference on Machine Learning, Sydney, Australia."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/17\/4\/520\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T17:05:56Z","timestamp":1760029556000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/17\/4\/520"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,3,30]]},"references-count":26,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2025,4]]}},"alternative-id":["sym17040520"],"URL":"https:\/\/doi.org\/10.3390\/sym17040520","relation":{},"ISSN":["2073-8994"],"issn-type":[{"value":"2073-8994","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,3,30]]}}}