The repository contains code refered to the work:

Giuseppina Andresini, Annalisa Appice, Donato Malerba

Nearest cluster-based intrusion detection through convolutional neural networks

Please cite our work if you find it useful for your research and work.

@article{ANDRESINI2021106798,
title = "Nearest cluster-based intrusion detection through convolutional neural networks",
journal = "Knowledge-Based Systems",
volume = "216",
pages = "106798",
year = "2021",
issn = "0950-7051",
doi = "https://doi.org/10.1016/j.knosys.2021.106798",
url = "http://www.sciencedirect.com/science/article/pii/S0950705121000617",
author = "Giuseppina Andresini and Annalisa Appice and Donato Malerba"
}

The code relies on the following python3.6+ libs.

Packages need are:

• Tensorflow 1.13
• Keras 2.3
• Matplotlib 2.2
• Pandas 0.23.4
• Numpy 1.15.4
• Scikit-learn

The datasets used for experiments are accessible from DATASETS. Original dataset is transformed in a binary classification: "attack, normal" (_oneCls files). The repository contains the orginal dataset (folder: "original") and the dataset after the preprocessing phase (folder: "numeric")

Preprocessing phase is done mapping categorical feature and performing the Min Max scaler.

• main.py : script to run CLAIRE

Tor run the code: main.py NameOfDataset (es CICIDS2017, UNSW__NB15 or KDDCUP99)

To replicate experiments reported in the work, you can use models and datasets stored in homonym folders. Global variables are stored in CLAIRE.conf file

    N_CLASSES = 2
    PREPROCESSING1 = 0  #if set to 1 code execute preprocessing phase on original date
    LOAD_AUTOENCODER = 1 #if 1 the autoencoder is loaded from models folder
    ORD_DATASET =1  #if 1 the dataset is ordered
    IMAGE=1 #if 1 the image dataset is loaded
    CLUSTERS=1 #if 1 the clustering step is performed
    LOAD_CLUSTERS=1 #if 1 the clustering model is loaded from models folder
    NUM_CLUSTERS=1000 #number of cluster trained
    LOAD_CNN = 1  #if 1 the classifier is loaded from models folder
    VALIDATION_SPLIT #the percentage of validation set used to train models

All datasets