# Multi-View Cluster Structure Guided One-Class BLS-Autoencoder for Intrusion Detection
## 1 Introduction  
In recent years, the rapid advancement of Internet of Things (IoT) technology has positioned network intrusion detection systems (IDS) as a critical component for ensuring IoT security. However, IDS usually deploy multiple sensors in different locations of the network and collect multi-view network traffic data by monitoring network traffic or system logs. Moreover, network intrusions are typically unknown threats, making the data collection process costly and difficult to perform comprehensively. These challenges have led to extensive research on multi-view one-class classification methods for anomaly detection, which aim to train the model based on normal traffic data from different sources, thus realizing the detection of unknown intrusions. To address the scarcity of anomalous samples in cybersecurity scenarios, one-class classification methods (OCC) have emerged as a specialized solution. Unlike conventional binary classification frameworks that require both normal and anomalous samples for training, OCC models are trained solely from normal samples, which enables the identification of unknown intrusions during testing. Early OCC research focused on adapting traditional machine learning techniques, such as support vector machines [1], K-nearest neighbors [2], and fuzzy learning [3], to one-class scenarios. However, these methods exhibited limited detection performance due to their shallow architectures and manual feature engineering constraints. Subsequent advancements introduced deep neural networks, including convolutional neural network [4], multi-layer perceptron-based [5], and adversarial network-based [6; 7; 8] frameworks, which improved feature representation capabilities at the cost of increased structural complexity. Recent innovations prioritize computational efficiency for edge-deployed IDS through simplified neural architectures. Notable advancements leverage flat network models like extreme learning machine (ELM) [9; 10] and the broad learning system (BLS) [11; 12]. These methods eliminate deep hierarchical structures while preserving detection efficacy, achieving rapid training convergence through analytical learning paradigms. Most existing OCC models are designed for single-view data, making them incapable of collaboratively learning multiple feature spaces from multi-source data. To address this limitation, some researchers began to explore multi-view one-class classification methods [13; 14; 15; 16]. However, current methods still have two main limitations: (1) They primarily focus on mapping multi-view features into a shared feature space and then using a single OCC model for anomaly detection. As a result, they require collecting multi-view traffic data from all sources and have difficulty detecting intrusion independently in each view. (2) Due to various network applications, normal traffic data contain potential subcategories, and these models lack consideration of the cross-view cluster structure. To address these problems, this paper proposes an intrusion detection framework based on a multi-view cluster structure guided one-class BLS-autoencoder (IDF-MOCBLSAE). Firstly, the ensemble clustering technique is utilized to derive multiple view-specific co-association matrices; then, a multi-view co-association matrix optimization objective function with doubly-stochastic constraints is designed to capture the global cluster structure. Secondly, a multi-view cluster structure guided one-class BLS-autoencoder (MOCBLSAE) is presented, which learns discriminative patterns of normal traffic data based on the cross-view global cluster structure and the reconstruction of intra-view local features, thereby enabling the identification of unknown anomalous data of each view. Finally, multiple MOCBLSAE models from different views are integrated into the intrusion detection framework to achieve both individual and ensemble intrusion detection. Extensive experiments on diverse OCC intrusion detection tasks are produced to demonstrate the effectiveness of the propose method.