###### Abstract  
The increasing prevalence of unknown-type attacks on the Internet highlights the importance of developing efficient intrusion detection systems. While machine learning-based techniques can detect unknown types of attacks, the need for innovative approaches becomes evident, as traditional methods may not be sufficient. In this research, we propose a deep learning-based solution called the log-cosh variational autoencoder (LVAE) to address this challenge. The LVAE inherits the strong modeling abilities of the variational autoencoder (VAE), enabling it to understand complex data distributions and generate reconstructed data. To better simulate discrete features of real attacks and generate unknown types of attacks, we introduce an effective reconstruction loss term utilizing the logarithmic hyperbolic cosine (log-cosh) function in the LVAE. Compared to conventional VAEs, the LVAE shows promising potential in generating data that closely resemble unknown attacks, which is a critical capability for improving the detection rate of unknown attacks. In order to classify the generated unknown data, we employed eight feature extraction and classification techniques. Numerous experiments were conducted using the latest CICIDS2017 dataset, training with varying amounts of real and unknown-type attacks. Our optimal experimental results surpassed several state-of-the-art techniques, achieving accuracy and average F1 scores of 99.89% and 99.83%, respectively. The suggested LVAE strategy also demonstrated outstanding performance in generating unknown attack data. Overall, our work establishes a solid foundation for accurately and efficiently identifying unknown types of attacks, contributing to the advancement of intrusion detection techniques. intrusion detection; variational autoencoder; deep learning attack of unknown type +
Footnote †: journal:  
identify attacks. These methods, however, are unable to identify novel attack variations, unknown attacks, or attacks from related families. By contrast, anomaly-based intrusion detection systems (IDSs) identify and label aberrant communications when they detect deviations from a model of typical user behavior [3, 4]. While anomaly-based IDSs can identify unknown or zero-day attacks, accurately capturing the ever-changing behaviors of network users can be challenging [5]. Efforts to develop intrusion detection systems that are capable of accurately identifying previously unidentified attack types have gained traction and are considered a hot topic in the research community. Many successful approaches have been developed in the past decade, most of which utilize predetermined rules for classification. These techniques rely on complex machine learning algorithms, such as Support Vector Machines (SVMs) [6] and Random Forests (RFs) [7], to distinguish different attack classes. However, traditional machine learning techniques often struggle to effectively learn high-dimensional data characteristics and are more inclined to focus on low-dimensional data features. Conventional machine learning techniques have several shortcomings: (a) They significantly rely on predetermined traffic features or properties and are not good at identifying unknown types of attacks; instead, they are best at detecting known attacks [8]. (b) Traditional intrusion detection algorithms lack scalability and adaptability to identify unknown types of attacks in dynamic network architectures [9]. (c) These methods rely on labeled data for training, which can be computationally expensive and susceptible to manipulation through artificial data, resulting in a decline in overall performance [9]. Deep learning techniques show great promise in effectively extracting significant features from large amounts of high-dimensional data [10, 11, 12, 13], addressing the challenge of constantly evolving network patterns. For example, refs. [14, 15] each propose two lightweight approaches and achieve lightweight while being able to defend against multiple security attacks.