# Multi-View Cluster Structure Guided One-Class BLS-Autoencoder for Intrusion Detection
## 5 Conclusions  
With the growing prevalence of network traffic data sharing across multiple sources, cybersecurity has become a critical priority. This paper proposes an intrusion detection framework based on a multi-view cluster structure guided one-class BLS-autoencoder (IDF-MOCBLSAE). A multi-view co-association matrix optimization objective function with doubly-stochastic constraints is first designed to combine view-specific spectral embeddings from ensemble partitions and better captures the underlying cluster structure across different views. Then, a multi-view cluster structure guided one-class BLS-autoencoder (MOCBLSAE) is proposed, which learns discriminative patterns of normal traffic data by preserving the cross-view clustering structure while minimizing the intra-view sample reconstruction errors. Finally, the intrusion detection framework is constructed based on multiple MOCBLSAEs to achieve both individual and ensemble intrusion detection. In the application, IDF-MOCBLSAE is deployed on the data analysis node of IDS. During the training phase, it collects multi-view normal network traffic data from multiple sources and trains MOCBLSAE models for each view. In the detection phase, each view-specific datum can be independently predicted using the corresponding MOCBLSAE model, without collecting data from all sources. In addition, to achieve a more comprehensive decision-making process, multiple view-specific prediction results can be integrated into the ensemble prediction by majority voting or one-vote veto strategies. To demonstrate the effectiveness of the proposed method, this paper conducts a series of experiments and analyzes the results: (1) IDF-MOCBLSAE is compared with state-of-the-art OCC methods. The experimental results show that IDF-MOCBLSAE achieves overall superior performance to the comparison methods. (2) The effects of two trade-off parameters in IDF-MOCBLSAE are analyzed, and the recommended parameter settings are provided. (3) The ablation analysis on IDF-MOCBLSAE is presented, which demonstrates the effectiveness of the cross-view cluster structure guidance in MOCBLSAE and the optimization of the multi-view co-association matrix. (4) The training efficiency of IDF-MOCBLSAE and the comparison OCC methods is evaluated. The experimental results show that IDF-MOCBLSAE can achieve better intrusion detection performance with training efficiency similar to state-of-the-art OCC methods. The limitations of the proposed method include the following: (1) The detection performance for high-dimensional noisy traffic data still needs further improvement. (2) The training process of IDF-MOCBLSAE is centralized, lacking an online learning mechanism for data streaming. Therefore, the future research directions are summarized as follows: (1) Incorporating attention mechanisms, feature attribution methods, or visualization clustering to identify discriminative features or views. (2) Exploring asynchronous incremental learning techniques for multi-view OCC models by integrating continual learning paradigms, enhancing adaptability to evolving threats. Funding acquisition, Y.S. ; Methodology, Q.Y., Y.-A.C. and Y.S. ; Supervision, Y.S. ; Validation, Q.Y. and Y.-A.C.; Writing--original draft, Q.Y. and Y.-A.C.; Writing--review and editing, Y.S. All authors have read and agreed to the published version of the manuscript. This work was supported in part by the National Natural Science Foundation of China under No. 62306122, the Fundamental Research Funds for the Central Universities under No. ZQN-1122, the Scientific Research Funds of Huaqiao University under Grant 24 BS141, and the High-level Talent Team Project of Quanzhou City under grant No. 2023 CT001. Not applicable.