Open AccessOpen Access


Multi-Layer Reconstruction Errors Autoencoding and Density Estimate for Network Anomaly Detection

Ruikun Li1,*, Yun Li2, Wen He1,3, Lirong Chen1, Jianchao Luo1

1 University of Electronic Science and Technology of China, Chengdu, 611730, China
2 Guangdong Weichen Information Technology Co., Ltd., Guangzhou, 510000, China
3 Chongqing Changan Automobile Corporation, Chongqing, 400000, China

* Corresponding Author: Ruikun Li. Email:

(This article belongs to this Special Issue: Intelligent Computing for Engineering Applications)

Computer Modeling in Engineering & Sciences 2021, 128(1), 381-398.


Anomaly detection is an important method for intrusion detection. In recent years, unsupervised methods have been widely researched because they do not require labeling. For example, a nonlinear autoencoder can use reconstruction errors to attain the discrimination threshold. This method is not effective when the model complexity is high or the data contains noise. The method for detecting the density of compressed features in a hidden layer can be used to reduce the influence of noise on the selection of the threshold because the density of abnormal data in hidden layers is smaller than normal data. However, compressed features may lose some of the high-dimensional distribution information of the original data. In this paper, we present an efficient anomaly detection framework for unsupervised anomaly detection, which includes network data capturing, processing, feature extraction, and anomaly detection. We employ a deep autoencoder to obtain compressed features and multi-layer reconstruction errors, and feeds them the same to the Gaussian mixture model to estimate the density. The proposed approach is trained and tested on multiple current intrusion detection datasets and real network scenes, and performance indicators, namely accuracy, recall, and F1-score, are better than other autoencoder models.


Cite This Article

Li, R., Li, Y., He, W., Chen, L., Luo, J. (2021). Multi-Layer Reconstruction Errors Autoencoding and Density Estimate for Network Anomaly Detection. CMES-Computer Modeling in Engineering & Sciences, 128(1), 381–398.

This work is licensed under a Creative Commons Attribution 4.0 International License , which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
  • 1769


  • 1046


  • 0


Share Link