USING BAYESIAN AND NEYMAN-PEARSON HYPOTHESIS TESTING FOR AUTOENCODER TO DETECT ANOMALIES IN NETWORK SECURITY

Abstract

An autoencoder is an unsupervised learning model whose parameters are finetuned so that the output vector is as close as possible to the input vector. In this paper, we use the autoencoder model to detect abnormal (attack) connections from normal connections on the Internet. The reconstruction error of the autoencoder will be used to classify connections into two classes: normal connections and abnormal connections. We present three methods to classify the connections: using a given threshold, Bayesian hypothesis testing, and Neyman-Pearson hypothesis testing. On the NSL KDD dataset, the average accuracy achieved by the three methods was .