An Investigation into the Performance of Non-Contrastive Self-Supervised Learning Methods for Network Intrusion Detection

EasyChair Preprint 14457, version 2

Abstract

Network intrusion detection, a well-explored cybersecurity field, has predominantly relied on supervised learning algorithms in the past two decades. However, their limitations in detecting only known anomalies prompt the exploration of alternative approaches. Motivated by the success of self-supervised learning in computer vision, there is a rising interest in adapting this paradigm for network intrusion detection. While prior research mainly delved into contrastive self-supervised methods, the efficacy of non-contrastive methods, in conjunction with encoder architectures serving as the representation learning backbone and augmentation strategies that determine what is learned, remains unclear for effective attack detection. This paper compares the performance of five non-contrastive self-supervised learning methods using three encoder architectures and six augmentation strategies. Ninety experiments are systematically conducted on two network intrusion detection datasets, UNSW-NB15 and 5G-NIDD. For each self-supervised model, the combination of encoder architecture and augmentation method yielding the highest average precision, recall, F1-score, and AUCROC is reported. Furthermore, by comparing the best-performing models to two unsupervised baselines, DeepSVDD, and an Autoencoder, we showcase the competitiveness of the non-contrastive methods for attack detection.

Keyphrases: Network Intrusion Detection, data augmentation, self-supervised learning

@booklet{EasyChair:14457,
  author    = {Hamed Fard and Tobias Schalau and Gerhard Wunder},
  title     = {An Investigation into the Performance of Non-Contrastive Self-Supervised Learning Methods for Network Intrusion Detection},
  howpublished = {EasyChair Preprint 14457},
  year      = {EasyChair, 2024}}