ARCADE: Adversarially Regularized Convolutional Autoencoder for Network
  Anomaly Detection
  As the number of heterogenous IP-connected devices and traffic volume
increase, so does the potential for security breaches. The undetected
exploitation of these breaches can bring severe cybersecurity and privacy
risks. In this paper, we present a practical unsupervised anomaly-based deep
learning detection system called ARCADE (Adversarially Regularized
Convolutional Autoencoder for unsupervised network anomaly DEtection). ARCADE
exploits the property of 1D Convolutional Neural Networks (CNNs) and Generative
Adversarial Networks (GAN) to automatically build a profile of the normal
traffic based on a subset of raw bytes of a few initial packets of network
flows so that potential network anomalies and intrusions can be effectively
detected before they could cause any more damage to the network. A
convolutional Autoencoder (AE) is proposed that suits online detection in
resource-constrained environments, and can be easily improved for environments
with higher computational capabilities. An adversarial training strategy is
proposed to regularize and decrease the AE's capabilities to reconstruct
network flows that are out of the normal distribution, and thereby improve its
anomaly detection capabilities. The proposed approach is more effective than
existing state-of-the-art deep learning approaches for network anomaly
detection and significantly reduces detection time. The evaluation results show
that the proposed approach is suitable for anomaly detection on
resource-constrained hardware platforms such as Raspberry Pi.
