Hybrid anomaly detection: Leveraging autoencoder for feature learning and random forest neural network for discriminative classification

Article type: Research Article

Authors: Maheswari, M.^{a; *} | Anitha, D.^a | Sharma, Aditi^b | Kaur, Kiranpreet^c | Balamurugan, V.^d | Garikapati, Bindu^e | Dineshkumar, R.^f | Karunakaran, P.^g

Affiliations: [a] Department of Computational Intelligence, School of Computing, SRM Institute of Science and Technology, Kattankulathur, India | [b] Department of Computer Science and Engineering, Symbiosis Institute of Technology, Symbiosis International University, Pune, Maharashtra, India | [c] Department of Computer Science and Engineering, Rayat Bahra University, India | [d] Department of ECE, Sathyabama Institute of Science and Technology, Chennai, India | [e] Department of Computer Science and Engineering, Koneru Lakshmaiah Education Foundation, Vaddeswaram, Guntur, Andhra Pradesh, India | [f] Department of ECE, Saveetha School of Engineering, Saveetha Institute of Medical and Technical Sciences, Saveetha University, Chennai, India | [g] Department of CSE, Erode Sengunthar Engineering College, Perundurai, Tamil Nadu, India

Correspondence: [*] Corresponding author. M. Maheswari, Department of Computational Intelligence, School of Computing, SRM Institute of Science and Technology, Kattankulathur, Tamil Nadu-603203, India. E-mail: maheswam@srmist.edu.in.

Abstract: Anomaly detection, a critical aspect of data analysis and cybersecurity, aims to identify unusual patterns that deviate from the expected norm. In this study, we propose a hybrid approach that combines the strengths of Autoencoder neural networks and Multiclass Support Vector Machines (SVM) for robust anomaly detection. The Autoencoder is utilized for feature learning and extraction, capturing intricate patterns in the data, while the Multiclass SVM provides a discriminative classification mechanism to distinguish anomalies from normal patterns. Specifically, the Autoencoder is trained on normal data to acquire a compact and efficient representation of the underlying patterns, with the reconstruction errors serving as indicative measures of anomalies. Concurrently, a Multiclass SVM is trained to classify instances into multiple classes, including an anomaly class. The anomaly scores from the Autoencoder and the decision function of the Multiclass SVM, along with that of the Random Forest Neural Network (AE-RFNN), are combined, leveraging their complementary strengths. A thresholding mechanism is then employed to classify instances as normal or anomalous based on the combined scores. The performance of the hybrid model is evaluated using standard metrics such as precision, recall, F1-score, and the area under the Receiver Operating Characteristic (ROC) curve. The proposed hybrid anomaly detection approach demonstrates effectiveness in capturing complex patterns and discerning anomalies across diverse datasets. Additionally, the model offers flexibility for adaptation to evolving data distributions. This study contributes to the advancement of anomaly detection methodologies by presenting a hybrid solution that combines feature learning and discriminative classification for improved accuracy and generalization.

Keywords: Anomaly detection, Autoencoder, Multiclass SVM, feature learning, hybrid model, cybersecurity

DOI: 10.3233/JIFS-240028

Journal: Journal of Intelligent & Fuzzy Systems, vol. Pre-press, no. Pre-press, pp. 1-14, 2024