Deep learning (DL) has emerged as a crucial tool in network anomaly detection (NAD) for cybersecurity. While DL models for anomaly detection excel at extracting features and learning patterns from data, they are vulnerable to data contamination -- the inadvertent inclusion of attack-related data in training sets presumed benign. This study evaluates the robustness of six unsupervised DL algorithms against data contamination using our proposed evaluation protocol. Results demonstrate significant performance degradation in state-of-the-art anomaly detection algorithms when exposed to contaminated data, highlighting the critical need for self-protection mechanisms in DL-based NAD models. To mitigate this vulnerability, we propose an enhanced auto-encoder with a constrained latent representation, allowing normal data to cluster more densely around a learnable center in the latent space. Our evaluation reveals that this approach exhibits improved resistance to data contamination compared to existing methods, offering a promising direction for more robust NAD systems.

本研究评估了六种无监督深度学习算法在数据污染下的鲁棒性，结果显示在污染数据下最先进的异常检测算法性能明显下降，强调了深度学习网络异常检测模型中自我保护机制的重要性。为了减轻这一漏洞，我们提出了一种增强的自动编码器，并限制其潜在表示，使正常数据在潜在空间中更密集地聚集在可学习中心周围。我们的评估结果表明，与现有方法相比，这种方法在面对数据污染时表现出更好的抵抗性，为实现更强大的网络异常检测系统提供了一个有希望的方向。

数据污染环境下的网络异常检测的深度学习：评估鲁棒性和减轻性能下降