Unknown Intrusion Traffic Detection Method Based on Unsupervised Learning and Open-set Recognition

Unknown Intrusion Traffic Detection Method Based on Unsupervised Learning and Open-set Recognition | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Unknown Intrusion Traffic Detection Method Based on Unsupervised Learning and Open-set Recognition Jun Fang, Cunxiang Xie This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-6201348/v1 This work is licensed under a CC BY 4.0 License Status: Published Journal Publication published 16 May, 2025 Read the published version in Scientific Reports → Version 1 posted 10 You are reading this latest preprint version Abstract Intrusion traffic detection technology is an important network protection technology to ensure network communication security and protect users' information privacy. To address problems relating to the low classification accuracy of current intrusion traffic detection algorithms and that most of the current research focus on closed set detection, this paper proposes a detection and classification model for open set traffic based on information maximization generative adversarial network and OpenMax algorithm. Firstly, the intrusion traffic classification model under the closed set condition is trained, and the sample activation vector is recalculated in the penultimate layer of the model by using the OpenMax algorithm. According to the activation vector of the known category, the estimated probability of the unknown category is then calculated to identify unknown traffic. Results show that the model's classification accuracy for CICIDS2017 open set traffic in the misuse and anomaly detection experiments is above 88.5% and 88.2%, respectively. The model can effectively detect various types of unknown traffic with high detection accuracy and robustness. Physical sciences/Engineering/Civil engineering Physical sciences/Engineering/Electrical and electronic engineering Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Published Journal Publication published 16 May, 2025 Read the published version in Scientific Reports → Version 1 posted Editorial decision: Revision requested 21 Mar, 2025 Reviews received at journal 20 Mar, 2025 Reviewers agreed at journal 19 Mar, 2025 Reviews received at journal 18 Mar, 2025 Reviewers agreed at journal 18 Mar, 2025 Reviewers invited by journal 18 Mar, 2025 Editor assigned by journal 18 Mar, 2025 Editor invited by journal 18 Mar, 2025 Submission checks completed at journal 15 Mar, 2025 First submitted to journal 11 Mar, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-6201348","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":431946856,"identity":"77af6eea-2458-4487-9684-2fce1da6fea5","order_by":0,"name":"Jun Fang","email":"","orcid":"","institution":"Naval Aviation University","correspondingAuthor":false,"prefix":"","firstName":"Jun","middleName":"","lastName":"Fang","suffix":""},{"id":431946857,"identity":"c9272ae0-60c3-45e2-98d9-45c9c6492bc0","order_by":1,"name":"Cunxiang Xie","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA/0lEQVRIiWNgGAWjYDACZgjFAyIOfKiwkWNjbz9AtBbGgzPOpBnz8ZxJIN7Cw7xthxLnSTgY4FVmcJz54GfeHYdl+Ge3XwBqOZDeJsGQwPCjYhtOLZLNbMnSvGfSeCTunCk4OOfcndw26cYDjD1nbuPUws/MY8bM22bDw3AjJ+HAm7JnuW0yBxKYGdtwa2Fj5v8G1CLBIw/SwsN2OJ1NIsEArxagLWxgWwxupB84yNN2OIGgFqBfjCXntqXxGN7IYQAFsmEbMJAP4vOLwfnDDz+8bTtsL3cj/fEHYFTKy7e3H3zwowK3FiTAg4iOA8SoBwL2B0QqHAWjYBSMgpEGAG7dWdhLW9HvAAAAAElFTkSuQmCC","orcid":"","institution":"Naval Aviation University","correspondingAuthor":true,"prefix":"","firstName":"Cunxiang","middleName":"","lastName":"Xie","suffix":""}],"badges":[],"createdAt":"2025-03-11 08:38:21","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-6201348/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-6201348/v1","draftVersion":[],"editorialEvents":[{"content":"https://doi.org/10.1038/s41598-025-01084-1","type":"published","date":"2025-05-16T15:57:00+00:00"}],"editorialNote":"","failedWorkflow":false,"files":[{"id":83067773,"identity":"71eaaf63-1583-4d1f-98f2-27dcdd4657c9","added_by":"auto","created_at":"2025-05-19 16:05:51","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1312458,"visible":true,"origin":"","legend":"","description":"","filename":"manuscript.doc.pdf","url":"https://assets-eu.researchsquare.com/files/rs-6201348/v1_covered_315fb71b-2234-42e6-8429-1cae3446d22d.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Unknown Intrusion Traffic Detection Method Based on Unsupervised Learning and Open-set Recognition","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":true,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true},"keywords":"","lastPublishedDoi":"10.21203/rs.3.rs-6201348/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-6201348/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eIntrusion traffic detection technology is an important network protection technology to ensure network communication security and protect users' information privacy. To address problems relating to the low classification accuracy of current intrusion traffic detection algorithms and that most of the current research focus on closed set detection, this paper proposes a detection and classification model for open set traffic based on information maximization generative adversarial network and OpenMax algorithm. Firstly, the intrusion traffic classification model under the closed set condition is trained, and the sample activation vector is recalculated in the penultimate layer of the model by using the OpenMax algorithm. According to the activation vector of the known category, the estimated probability of the unknown category is then calculated to identify unknown traffic. Results show that the model's classification accuracy for CICIDS2017 open set traffic in the misuse and anomaly detection experiments is above 88.5% and 88.2%, respectively. The model can effectively detect various types of unknown traffic with high detection accuracy and robustness.\u003c/p\u003e","manuscriptTitle":"Unknown Intrusion Traffic Detection Method Based on Unsupervised Learning and Open-set Recognition","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-03-27 06:03:28","doi":"10.21203/rs.3.rs-6201348/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2025-03-21T07:33:54+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-03-20T07:50:17+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"320714872752441485917216047203397874204","date":"2025-03-20T02:21:47+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-03-19T03:25:15+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"89245986617003027527011527267144948958","date":"2025-03-19T01:18:37+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-03-18T07:38:25+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-03-18T07:32:03+00:00","index":"","fulltext":""},{"type":"editorInvited","content":"","date":"2025-03-18T04:24:53+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-03-15T11:16:37+00:00","index":"","fulltext":""},{"type":"submitted","content":"Scientific Reports","date":"2025-03-11T08:32:38+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"f2fad68a-4f35-4688-a2d4-9d936d61de5b","owner":[],"postedDate":"March 27th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"published-in-journal","subjectAreas":[{"id":46009092,"name":"Physical sciences/Engineering/Civil engineering"},{"id":46009093,"name":"Physical sciences/Engineering/Electrical and electronic engineering"}],"tags":[],"updatedAt":"2025-05-19T15:59:56+00:00","versionOfRecord":{"articleIdentity":"rs-6201348","link":"https://doi.org/10.1038/s41598-025-01084-1","journal":{"identity":"scientific-reports","isVorOnly":false,"title":"Scientific Reports"},"publishedOn":"2025-05-16 15:57:00","publishedOnDateReadable":"May 16th, 2025"},"versionCreatedAt":"2025-03-27 06:03:28","video":"","vorDoi":"10.1038/s41598-025-01084-1","vorDoiUrl":"https://doi.org/10.1038/s41598-025-01084-1","workflowStages":[]},"version":"v1","identity":"rs-6201348","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-6201348","identity":"rs-6201348","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}