{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/kitsune-an-ensemble-of-autoencoders-for","title":"Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection","arxiv_id":"1802.09089","date":"2018-02-25","proceeding":null,"authors":["Yisroel Mirsky","Tomer Doitshman","Yuval Elovici","Asaf Shabtai"],"abstract":"Neural networks have become an increasingly popular solution for network\nintrusion detection systems (NIDS). Their capability of learning complex\npatterns and behaviors make them a suitable solution for differentiating\nbetween normal traffic and network attacks. However, a drawback of neural\nnetworks is the amount of resources needed to train them. Many network gateways\nand routers devices, which could potentially host an NIDS, simply do not have\nthe memory or processing power to train and sometimes even execute such models.\nMore importantly, the existing neural network solutions are trained in a\nsupervised manner. Meaning that an expert must label the network traffic and\nupdate the model manually from time to time.\n  In this paper, we present Kitsune: a plug and play NIDS which can learn to\ndetect attacks on the local network, without supervision, and in an efficient\nonline manner. Kitsune's core algorithm (KitNET) uses an ensemble of neural\nnetworks called autoencoders to collectively differentiate between normal and\nabnormal traffic patterns. KitNET is supported by a feature extraction\nframework which efficiently tracks the patterns of every network channel. Our\nevaluations show that Kitsune can detect various attacks with a performance\ncomparable to offline anomaly detectors, even on a Raspberry PI. This\ndemonstrates that Kitsune can be a practical and economic NIDS.","url_abs":"http://arxiv.org/abs/1802.09089v2","url_pdf":"http://arxiv.org/pdf/1802.09089v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"kitsune-an-ensemble-of-autoencoders-for","repo_url":"https://github.com/ymirsky/KitNET-py","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"none","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"kitsune-an-ensemble-of-autoencoders-for","repo_url":"https://github.com/Guillem96/kitsune-pytorch","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"GPL-3.0"}},{"paper_slug":"kitsune-an-ensemble-of-autoencoders-for","repo_url":"https://github.com/ymirsky/Kitsune-py","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"none","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"intrusion-detection","task_name":"Intrusion Detection"},{"task_slug":"network-intrusion-detection","task_name":"Network Intrusion Detection"}],"methods":[{"method_slug":"ae","method_name":"AE"}],"datasets_introduced":[{"slug":"kitsune-network-attack-dataset","name":"Kitsune Network Attack Dataset","full_name":""}],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1802.09089","atlas_url":"https://app.syntology.ai/?focus=1802.09089","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1802.09089"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Guillem96/kitsune-pytorch","reach":{"status":"ok","spdx":"GPL-3.0"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ymirsky/KitNET-py","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ymirsky/Kitsune-py","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":3},"by_repo_kind":{"official":{"samples":3,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"580d9ac7c7cb0bf7","entry":"invLogCDF","repo":"ymirsky/KitNET-py","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ymirsky/KitNET-py/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"580d9ac7c7cb0bf7"}},{"code_sha256_prefix":"abf814a83e71f748","entry":"pdf","repo":"ymirsky/KitNET-py","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ymirsky/KitNET-py/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"abf814a83e71f748"}},{"code_sha256_prefix":"e1266296545920e8","entry":"sigmoid","repo":"ymirsky/KitNET-py","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ymirsky/KitNET-py/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e1266296545920e8"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}