Network anomaly detection using channel boosted and residual learning based deep convolutional neural network

Abstract Anomaly detection in a network is one of the prime concerns for network security. In this work, a novel Channel Boosted and Residual learning based deep Convolutional Neural Network (CBR-CNN) architecture is proposed for the detection of network intrusions. The proposed methodology is based on inherent nature of the anomaly detection in which one class classification approach is used to detect network intrusion. This is accomplished by the modelling of normal network traffic distribution using Stacked Autoencoders (SAE). Using unsupervised training, SAE transforms the original feature space into a reconstructed feature space, which is further transformed via the proposed concept of channel boosting. Additionally, in order to increase the representational power of the neural network and the diversity in features representation, a multipath residual learning based CNN architecture is proposed to learn features at different levels of granularity. Performance of the proposed CBR-CNN technique is evaluated on NSL-KDD dataset. Our proposed method showed significant improvement over the existing techniques, achieving accuracy, AU-ROC, and AU-PR of 89.41%, 0.9473, and 0.9443 on Test + and 80.36%, 0.7348 and 0.9034 on Test−21 dataset, respectively.