These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Network intrusion detection remains a critical challenge in cybersecurity.
While supervised machine learning models achieve state-of-the-art performance,
their reliance on large labelled datasets makes them impractical for many
real-world applications. Anomaly detection methods, which train exclusively on
benign traffic to identify malicious activity, suffer from high false positive
rates, limiting their usability. Recently, self-supervised learning techniques
have demonstrated improved performance with lower false positive rates by
learning discriminative latent representations of benign traffic. In
particular, contrastive self-supervised models achieve this by minimizing the
distance between similar (positive) views of benign traffic while maximizing it
between dissimilar (negative) views. Existing approaches generate positive
views through data augmentation and treat other samples as negative. In
contrast, this work introduces Contrastive Learning using Augmented Negative
pairs (CLAN), a novel paradigm for network intrusion detection where augmented
samples are treated as negative views - representing potentially malicious
distributions - while other benign samples serve as positive views. This
approach enhances both classification accuracy and inference efficiency after
pretraining on benign traffic. Experimental evaluation on the Lycos2017 dataset
demonstrates that the proposed method surpasses existing self-supervised and
anomaly detection techniques in a binary classification task. Furthermore, when
fine-tuned on a limited labelled dataset, the proposed approach achieves
superior multi-class classification performance compared to existing
self-supervised models.