Hybrid anomaly detection: Leveraging autoencoder for feature learning and random forest neural network for discriminative classification

Abstract

Anomaly detection, a critical aspect of data analysis and cybersecurity, aims to identify unusual patterns that deviate from the expected norm. In this study, we propose a hybrid approach that combines the strengths of Autoencoder neural networks and Multiclass Support Vector Machines (SVM) for robust anomaly detection. The Autoencoder is utilized for feature learning and extraction, capturing intricate patterns in the data, while the Multiclass SVM provides a discriminative classification mechanism to distinguish anomalies from normal patterns. Specifically, the Autoencoder is trained on normal data to acquire a compact and efficient representation of the underlying patterns, with the reconstruction errors serving as indicative measures of anomalies. Concurrently, a Multiclass SVM is trained to classify instances into multiple classes, including an anomaly class. The anomaly scores from the Autoencoder and the decision function of the Multiclass SVM, along with that of the Random Forest Neural Network (AE-RFNN), are combined, leveraging their complementary strengths. A thresholding mechanism is then employed to classify instances as normal or anomalous based on the combined scores. The performance of the hybrid model is evaluated using standard metrics such as precision, recall, F1-score, and the area under the Receiver Operating Characteristic (ROC) curve. The proposed hybrid anomaly detection approach demonstrates effectiveness in capturing complex patterns and discerning anomalies across diverse datasets. Additionally, the model offers flexibility for adaptation to evolving data distributions. This study contributes to the advancement of anomaly detection methodologies by presenting a hybrid solution that combines feature learning and discriminative classification for improved accuracy and generalization.