With massive data being generated daily and the ever-increasing
interconnectivity of the world's Internet infrastructures, a machine learning
based intrusion detection system (IDS) has become a vital component to protect
our economic and national security. In this paper, we perform a comprehensive
study on NSL-KDD, a network traffic dataset, by visualizing patterns and
employing different learning-based models to detect cyber attacks. Unlike
previous shallow learning and deep learning models that use the single learning
model approach for intrusion detection, we adopt a hierarchy strategy, in which
the intrusion and normal behavior are classified firstly, and then the specific
types of attacks are classified. We demonstrate the advantage of the
unsupervised representation learning model in binary intrusion detection tasks.
Besides, we alleviate the data imbalance problem with SVM-SMOTE oversampling
technique in 4-class classification and further demonstrate the effectiveness
and the drawback of the oversampling mechanism with a deep neural network as a
base model.

本文通过采用不同的基于学习的模型来检测网络攻击，演示了无监督表示学习模型在二进制入侵检测任务中的优势，并使用 SVM-SMOTE 过采样技术缓解了 4 类分类中的数据不平衡问题，并进一步展示了过采样机制的有效性及其深入神经网络基础模型的缺陷。