Anomaly Detection and Objective Security Evaluation Using Autoencoder, Isolation Forest, and Multi-Criteria Decision Methods

With the rapid development of cybersecurity technologies, cybersecurity testing has played an increasingly critical role in scientific research, new technology validation, system performance evaluation, and talent development. A central challenge in this domain lies in efficiently and rapidly constructing testing environments while ensuring the reliability and reproducibility of test results. To address this issue, this paper proposes an integrated evaluation method specifically designed for cybersecurity testing, combining anomaly detection and predictive analysis techniques. The method first employs an autoencoder (AE) to perform dimensionality reduction on the raw data collected from a testbed environment, followed by anomaly detection using the Isolation Forest (IF) algorithm. To assess the impact of cyberattacks on the stability of the testbed system, the steady-state data of the environment was treated as the ideal reference. The degree of disruption was then quantified by calculating the Euclidean distance between the dimensionally reduced experimental data and the reference state. Finally, a specific case study was conducted to validate the feasibility and effectiveness of the proposed method, and a percentage-based scoring mechanism was introduced to quantitatively evaluate the security level of the system.