The Pipeline of VAE base Network Traffic Anomaly Detection Algorithm

The advent of the Internet has led to a heightened awareness of network security among users. While traditional intrusion detection models exhibit high detection accuracy, they require many labeled samples for model training. Furthermore, the emergence of unsupervised deep learning models has introduced the challenge of threshold selection. A novel flow intrusion detection system has been developed to address the challenges of data labeling and threshold selection. This system employs a Variational Auto-Encoder (VAE) model and a normalized MSE threshold selection method. It has been demonstrated to effectively identify flow intrusions, thereby reducing the burden of data labeling. The experimental results on the NSL-KDD dataset demonstrate that, compared with the traditional unsupervised algorithm, the VAE model exhibits a superior performance in terms of the area under the curve (AUC).