Multi-View Cluster Structure Guided One-Class BLS-Autoencoder for Intrusion Detection

Abstract

Intrusion detection systems are crucial for cybersecurity applications. Network traffic data originate from diverse terminal sources, exhibiting multi-view feature spaces, while the collection of unknown intrusion data is costly. Current one-class classification (OCC) approaches are mainly designed for single-view data. Multi-view OCC approaches usually require collecting multi-view traffic data from all sources and have difficulty detecting intrusion independently in each view. Furthermore, they commonly ignore the potential subcategories in normal traffic data. To address these limitations, this paper utilizes the Broad Learning System (BLS) technique and proposes an intrusion detection framework based on a multi-view cluster structure guided one-class BLS-autoencoder (IDF-MOCBLSAE). Specifically, a multi-view co-association matrix optimization objective function with doubly-stochastic constraints is first designed to capture the cross-view cluster structure. Then, a multi-view cluster structure guided one-class BLS-autoencoder (MOCBLSAEs) is proposed, which learns the discriminative patterns of normal traffic data by preserving the cross-view clustering structure while minimizing the intra-view sample reconstruction errors, thereby enabling the identification of unknown intrusion data. Finally, an intrusion detection framework is constructed based on multiple MOCBLSAEs to achieve both individual and ensemble intrusion detection. Through experimentation, IDF-MOCBLSAE is validated on real-world network traffic datasets for multi-view one-class classification tasks, demonstrating its superiority over state-of-the-art one-class approaches.

1. Introduction

In recent years, the rapid advancement of Internet of Things (IoT) technology has positioned network intrusion detection systems (IDS) as a critical component for ensuring IoT security. However, IDS usually deploy multiple sensors in different locations of the network and collect multi-view network traffic data by monitoring network traffic or system logs. Moreover, network intrusions are typically unknown threats, making the data collection process costly and difficult to perform comprehensively. These challenges have led to extensive research on multi-view one-class classification methods for anomaly detection, which aim to train the model based on normal traffic data from different sources, thus realizing the detection of unknown intrusions.

To address the scarcity of anomalous samples in cybersecurity scenarios, one-class classification methods (OCC) have emerged as a specialized solution. Unlike conventional binary classification frameworks that require both normal and anomalous samples for training, OCC models are trained solely from normal samples, which enables the identification of unknown intrusions during testing. Early OCC research focused on adapting traditional machine learning techniques, such as support vector machines [1], K-nearest neighbors [2], and fuzzy learning [3], to one-class scenarios. However, these methods exhibited limited detection performance due to their shallow architectures and manual feature engineering constraints. Subsequent advancements introduced deep neural networks, including convolutional neural network [4], multi-layer perceptron-based [5], and adversarial network-based [6,7,8] frameworks, which improved feature representation capabilities at the cost of increased structural complexity. Recent innovations prioritize computational efficiency for edge-deployed IDS through simplified neural architectures. Notable advancements leverage flat network models like extreme learning machine (ELM) [9,10] and the broad learning system (BLS) [11,12]. These methods eliminate deep hierarchical structures while preserving detection efficacy, achieving rapid training convergence through analytical learning paradigms.

Most existing OCC models are designed for single-view data, making them incapable of collaboratively learning multiple feature spaces from multi-source data. To address this limitation, some researchers began to explore multi-view one-class classification methods [13,14,15,16]. However, current methods still have two main limitations: (1) They primarily focus on mapping multi-view features into a shared feature space and then using a single OCC model for anomaly detection. As a result, they require collecting multi-view traffic data from all sources and have difficulty detecting intrusion independently in each view. (2) Due to various network applications, normal traffic data contain potential subcategories, and these models lack consideration of the cross-view cluster structure.

To address these problems, this paper proposes an intrusion detection framework based on a multi-view cluster structure guided one-class BLS-autoencoder (IDF-MOCBLSAE). Firstly, the ensemble clustering technique is utilized to derive multiple view-specific co-association matrices; then, a multi-view co-association matrix optimization objective function with doubly-stochastic constraints is designed to capture the global cluster structure. Secondly, a multi-view cluster structure guided one-class BLS-autoencoder (MOCBLSAE) is presented, which learns discriminative patterns of normal traffic data based on the cross-view global cluster structure and the reconstruction of intra-view local features, thereby enabling the identification of unknown anomalous data of each view. Finally, multiple MOCBLSAE models from different views are integrated into the intrusion detection framework to achieve both individual and ensemble intrusion detection. Extensive experiments on diverse OCC intrusion detection tasks are produced to demonstrate the effectiveness of the propose method. In summary, the main contributions of this paper are as follows:

1.

A multi-view co-association matrix optimization objective function with doubly-stochastic constraints is designed, which systematically unifies view-specific spectral embedding from ensemble partitions and better captures the underlying cluster structure across different views.

2.

A multi-view cluster structure guided one-class BLS-autoencoder (MOCBLSAE) is proposed, which learns discriminative patterns of normal traffic data by preserving the cross-view clustering structure while minimizing the intra-view sample reconstruction errors, thereby enabling the identification of unknown intrusion data.

3.

Based on MOCBLSAE, an intrusion detection framework is constructed and validated on real-world network traffic datasets for multi-view one-class classification tasks, demonstrating its superiority over state-of-the-art one-class methods.

The subsequent sections of this paper are structured as follows. Section 2 reviews related works on single-view and multi-view one-class classification. Section 3 introduces the proposed method in detail. Section 4 validates the effectiveness of the proposed method through a series of experiments. Section 5 summarizes this paper and discusses potential future research.

2. Related Works

In scenarios of extreme class imbalance, one-class classification (OCC) methods have been extensively investigated. These methods exclusively utilize samples of the target class during the training phase to develop discriminative models, which subsequently enable the detection of anomalous samples deviating from the target class during testing. Current research in OCC can be systematically categorized into three primary approaches: traditional machine learning-based, neural network-based, and multi-view OCC approaches.

Traditional machine learning-based OCC approaches were proposed previously which aimed to modify classic classification models to adapt to OCC scenarios. For example, Scholkopf et al. [17] proposed a classical one-class classification algorithm based on the principle of a support vector machine (SVM). Tax et al. [18] proposed the support vector data description (SVDD), which learned a decision boundary in the kernel space by minimizing the distance from the normal samples to the boundary. Pang et al. [1] improved the one-class SVM using vector quantization techniques, which enhanced the generalization across different OCC tasks. Ji et al. [19] combined one-class SVM with a long short-term memory network to improve the ability to discern anomalies in time-series data. Swarnkar et al. [20] designed a one-class Bayesian model for detecting HTTP attacks, reducing computational complexity while improving detection accuracy. Gornitz et al. [21] introduced a clustering-driven SVDD algorithm that constructed multiple spheres in the kernel space via K-means to identify anomalous data. Li et al. [3] proposed boundary-based fuzzy-SVDD by introducing a local–global center distance to identify boundary-proximate samples, which led to a more accurate classification boundary.

Neural network-based OCC approaches have garnered significant research interest in recent years, demonstrating superior detection capabilities in complex data environments. Many one-class deep neural networks have been proposed. For example, Pu et al. [6] presented a bi-directional generative adversarial network (GAN) for latent feature extraction of normal patterns. Peng et al. [7] designed a dual-iteration GAN framework with auxiliary losses to minimize the intra-class variance of normal samples. Xu et al. [5] proposed a calibrated one-class learning method which combines uncertainty modeling and synthetic anomalies to enhance contamination-robust normality boundary learning in anomaly detection. Massoli et al. [22] introduced multilayer one-class learning via hierarchical autoencoder optimization, combining layer-wise feature refinement and centroid-aligned training for enhanced anomaly detection across deep representations. Dong et al. [4] proposed a multitask deep one-class convolutional neural network combining an autoencoder for feature learning and a moving-window scanning approach for detection. Ding et al. [8] designed an end-to-end framework of deep transfer one-class classification, which combined adversarial generation of pseudo-negative samples with log-Euclidean manifold alignment of cross-domain positive samples to enhance discrimination and representation learning. Mauceri et al. [23] embedded time series into a latent space where the Euclidean distances matched the original dissimilarity measures using autoencoder and encoder-only neural networks. Furthermore, a series of one-class flat-structure neural networks were explored based on the extreme learning machine (ELM) [24] and the broad learning system (BLS) [25]. For example, Yang et al. [12] developed a stacked one-class BLS framework to separately extract normal traffic features and detect anomalies. Lin et al. [11] introduced a one-class BLS network with a maximum correntropy and boosting scheme to improve performance. Cao et al. [26] proposed a hierarchical ELM-based approach leveraging maximum mutual information to improve adversarial robustness. Yang et al. [27] presented an online sequential ELM capable of incrementally learning key features from normal data. Zhong et al. [28] enhanced the conventional BLS by incorporating a memory module to strengthen normal pattern representation.

Most existing OCC models are designed for single-view data, making them incapable of collaboratively learning multiple feature spaces from multi-source data. To address this limitation, some researchers began to explore multi-view one-class classification methods. For example, Xiao et al. [13] proposed a multi-view one-class SVM integrating privileged information learning to enforce both consensus and complementarity principles through quadratic programming. Lei et al. [14] designed a deep OCC framework with one-class crop extraction loss for multi-modal satellite imagery. Golo et al. [15] presented a one-class multi-modal learning method for detecting relevant reviews. Sohrab et al. [16] projected data from multiple modalities to a new subspace optimized for one-class classification.

3. Proposed Method

This section introduces the proposed method in detail, including the definition of symbols and the task, the process of multi-view co-association matrix optimization, and the intrusion detection framework, based on the multi-view cluster structure guided one-class BLS-autoencoder.

3.1. Definition

The training set from multiple sources is given by multi-view network traffic data $X=\{X^1,\dots ,X^V\}$, where V is the number of data sources (views). For each view data $X^v\in {\mathbb{R}}^{n\times d_v}$ ($v=1,\dots ,V$), the number of samples and features are n and $d_v$, respectively. In the scenario of one-class intrusion detection, all multi-view training samples are normal traffic data (assumed to be labeled as 1). The multi-view one-class approach aims to jointly learn discriminative patterns of normal traffic data in the multi-view feature spaces, thereby enabling autonomous identification of anomalous traffic data during the application phase.

3.2. Multi-View Co-Association Matrix Optimization

Although all training samples are labeled as normal traffic data, they contain latent subcategories stemming from diverse network applications. Based on this intuition, a multi-view co-association matrix is first constructed from multi-view data, which preserves the cluster structure of samples.

Considering the efficiency and robustness of clustering structure analysis, an ensemble clustering strategy is adopted, which applies K-means in each view to obtain multiple base partitions $\{P_1^v,\dots ,P_B^v\}$, where B is the number of base partition in the v-th view. Each base partition is represented as a binary partition matrix $P_b^v\in {\mathbb{R}}^{n\times c_b}$ [29]; the $ij$-th entry of $P_b^v$ is defined as follows:

$$P_{b\left(ij\right)}^v=\left\{\begin{array}{cc}1,\hfill & if{x}_i\in C_j,\hfill \\ 0,\hfill & otherwise,\hfill \end{array}\right.$$

(1)

where $C_j$ is the j-th cluster, and $c_b$ is the number of clusters randomly set within a certain range. By horizontally concatenating the binary partition matrices, the ensemble binary partition matrix $P^v$ is obtained for the v-th view, and the co-association matrix $G^v\in {\mathbb{R}}^{n\times n}$ can be further computed as follows:

$$G^v={\displaystyle \frac{1}{B}}{P}^v{\left(P^v\right)}^T,$$

(2)

$$P^v=[P_1^v{P}_2^v\dots P_B^v].$$

(3)

It can be observed that $G^v$ effectively integrates diverse base partitions, representing the probability of sample pairs being assigned to the same cluster. This enables $G^v$ to comprehensively capture the intrinsic cluster structure relationship among samples within the v-th view.

Network traffic data collected from multiple sources reflect inter-sample relationships from different perspectives. Therefore, it is necessary to further integrate cross-view co-association matrices to obtain more robust cluster structure information.

However, simply averaging multiple view-specific co-association matrices fails to effectively integrate cluster structure information across different views. To address this problem, a multi-view co-association matrix optimization objective function with doubly-stochastic constraints is proposed as follows:

$$\begin{array}{cc}\hfill & \underset{G}{min}\sum _{v=1}^V\left|\right|G-G^v{\left|\right|}_F^2,\hfill \\ \hfill & s.t.G\ge 0,G\mathbf{1}=\mathbf{1},G^T=G.\hfill \end{array}$$

(4)

In the absence of prior knowledge, all views are treated equally to learn a multi-view co-association matrix that approximates the view-specific co-association matrices. By imposing doubly-stochastic constraints, the spectral relationships between samples are further refined, yielding a globally optimized co-association matrix that better reflects the underlying cluster structure across different views.

By setting $Q={\displaystyle \frac{1}{V}}{\sum }_{v=1}^V{G}^v$, problem (4) can be reformulated into a doubly-stochastic normalization problem under the Frobenius norm [30] as follows:

$$\begin{array}{cc}\hfill & \underset{G}{min}\left|\right|G-{Q\left|\right|}_F^2,\hfill \\ \hfill & s.t.G\ge 0,G\mathbf{1}=\mathbf{1},G^T=G.\hfill \end{array}$$

(5)

Then, according to the von Neumann successive projection lemma, the global optimal solution can be derived by iteratively solving the following two problems:

$$\underset{G}{min}\left|\right|G-{Q\left|\right|}_F^2,s.t.G\mathbf{1}=\mathbf{1},G^T=G.$$

(6)

$$\underset{G}{min}\left|\right|G-{Q\left|\right|}_F^2,s.t.G\ge 0.$$

(7)

The closed form solution of the problem (6) can be optimized by the Lagrange method as follows:

$$G=Q+({\displaystyle \frac{I-Q}{n}}+{\displaystyle \frac{\mathbf{1}{\mathbf{1}}^{T}Q}{n^2}})\mathbf{1}{\mathbf{1}}^T-{\displaystyle \frac{1}{n}}\mathbf{1}{\mathbf{1}}^{T}Q.$$

(8)

As for problem (7), it can be solved by simply projecting it onto a non-zero space as follows:

$$G=Q^{+}.$$

(9)

In general, the initial G is $G=Q={\displaystyle \frac{1}{V}}{\sum }_{v=1}^V{G}^v$. Then, it is iteratively updated by computing $Q=G$ and Equations (8) and (9) until convergence to obtain the multi-view co-association matrix. The pseudo code of the multi-view co-association matrix optimization is shown in Algorithm 1.

Algorithm 1 Multi-view co-association matrix optimization

Require:  Input: Multi-view training set $X=\{X^1,\dots ,X^V\}$. Ensure: 1: for each view $v=1$ to V do 2:     Apply K-means to produce B base partitions and compute the corresponding binary partition matrices $\{P_1^v,\dots ,P_B^v\}$ according to Equation (1); 3:     Compute the view-specific co-association matrix $G^v$ according to Equations (2) and (3); 4: end for 5: Compute $Q={\displaystyle \frac{1}{V}}{\sum }_{v=1}^V{G}^v$; 6: repeat 7:     Update G according to Equation (8); 8:     Update $G=G^{+}$; 9:     Update $Q=G$; 10: untilG converges Output The multi-view co-association matrix G;

3.3. Intrusion Detection Framework Based on the Multi-View Cluster Structure Guided One-Class BLS-Autoencoder

In the scenario of multi-view one-class intrusion detection, network traffic data originate from diverse terminal devices, and the training set consists of only normal samples, making conventional binary classification algorithms difficult to adapt directly. To this end, this paper aims to fully leverage multi-view normal samples to train an intrusion detection model, which identifies anomalous samples independently and efficiently across different data sources while maintaining ensemble decision-making capabilities. Instead of learning the direct mapping relationship between samples and class labels, this paper proposes a multi-view cluster structure guided one-class BLS-autoencoder (MOCBLSAE), which learns discriminative patterns of normal traffic data based on the cross-view global cluster structure and the reconstruction of intra-view local features, thereby enabling the identification of unknown anomalous samples. Finally, an intrusion detection framework is constructed based on multiple MOCBLSAE models.

The framework of MOCBLSAE is shown in Figure 1. Specifically, in the v-th view, MOCBLSAE first applies orthogonal stochastic weights and biases during the generation of feature nodes and enhancement nodes, then constructs the hidden layer $A^v$ by concatenating multiple feature nodes and enhancement nodes to enhance the model’s generalization capability [31] as follows:

$$A^v=[F_1^v{F}_2^v\dots F_p^v{E}_1^v{E}_2^v\dots E_q^v],$$

(10)

$$\begin{array}{cc}\hfill & F_i^v={\varphi }_f(X^v{W}_i^v+C_i^v),\hfill \\ \hfill s.t.W_i^v{\left(W_i^v\right)}^T=I& ,{\left(C_i^v\right)}_u{\left(C_i^v\right)}_u^T=1,{\left(C_i^v\right)}_u={\left(C_i^v\right)}_v,\hfill \end{array}$$

(11)

$$\begin{array}{cc}\hfill & E_j^v={\varphi }_e(X^v{W}_j^v+C_j^v),\hfill \\ \hfill s.t.W_j^v{\left(W_j^v\right)}^T=I& ,{\left(C_j^v\right)}_u{\left(C_j^v\right)}_u^T=1,{\left(C_j^v\right)}_u={\left(C_j^v\right)}_v,\hfill \end{array}$$

(12)

where $W_i^v$ and $W_j^v$ are orthogonal stochastic weight matrices, $C_i^v$ and $C_j^v$ are orthogonal stochastic bias matrices, ${\left(C_i^v\right)}_u$ and ${\left(C_j^v\right)}_u$ are the u-th row vectors of $C_i^v$ and $C_j^v$, and ${\varphi }_f$ and ${\varphi }_e$ are activation functions.

After obtaining the hidden layer $A^v\in {\mathbb{R}}^{n\times l}$, MOCBLSAE incorporates global cluster structure information to capture the discriminative patterns of diverse normal samples, thereby achieving effective data reconstruction. In addition, MOCBLSAE lacks reconstruction capability for anomalous data, allowing for rapid identification through reconstruction errors. Based on this idea, the objective function of MOCBLSAE is designed as follows:

$$\underset{W^v}{min}\left|\right|A^v{W}^v-X^v{\left|\right|}_F^2+\lambda \left|\right|W^v{\left|\right|}_F^2+{\displaystyle \frac{\alpha }{2}}\sum _{i=1}^n\sum _{j=1}^n{g}_{ij}·\left|\right|{\left({\left(W^v\right)}^T{\left(A^v\right)}^T\right)}_i-{\left({\left(W^v\right)}^T{\left(A^v\right)}^T\right)}_j{\left|\right|}_2^2,$$

(13)

where $A^v$ is the hidden layer, $W^v$ is the connecting matrix between the hidden layer and the output layer, $g_{ij}$ is the $ij$-th entry of the global co-association matrix G, ${\left({\left(W^v\right)}^T{\left(A^v\right)}^T\right)}_i$ represents the column vector of ${\left(W^v\right)}^T{\left(A^v\right)}^T$, and $\lambda$ and $\alpha$ are trade-off parameters. The first term of problem (13) minimizes the reconstruction error of normal samples, the second term prevents overfitting by imposing the Frobenius norm, and the third term preserves the global cluster relationships among samples.

In order to optimize the objective function, it can be reformulated into a matrix form as follows:

$$\underset{W^v}{min}J=\left|\right|A^v{W}^v-X^v{\left|\right|}_F^2+\lambda \left|\right|W^v{\left|\right|}_F^2+\alpha Tr\left({\left(W^v\right)}^T{\left(A^v\right)}^T{L}_G{W}^v{A}^v\right),$$

(14)

where $L_G$ is the Laplacian matrix of G. By setting $\partial J/\partial W^v=0$, the following equation can be obtained:

$${\displaystyle \frac{\partial J}{\partial W^v}}=2({\left(A^v\right)}^T{A}^v+\lambda I+\alpha {\left(A^v\right)}^T{L}_G{A}^v)W^v-2{\left(A^v\right)}^T{X}^v=0.$$

(15)

When the training data are sufficient (i.e., $n\ge l$), $A^v$ is a full-rank matrix, and Equation (15) has a closed-form solution. When the training data are insufficient (i.e., $n<l$), Equation  (15) has infinite solutions, $W^v=A^{v}D(D\in {\mathbb{R}}^{n\times n})$ can be imposed on $W^v$ and both sides of the equation multiplied by ${\left({\left(A^v\right)}^T{A}^v\right)}^{-1}{A}^v$ to obtain a unique solution [32]. In general, Equation (15) can be efficiently solved as follows:

$$W^v=\left\{\begin{array}{cc}\hfill & {\left[\lambda I+{\left(A^v\right)}^T{A}^v+\alpha {\left(A^v\right)}^T{L}_G{A}^v\right]}^{-1}{\left(A^v\right)}^T{X}^v,n\ge l,\hfill \\ \hfill & {\left(A^v\right)}^T{\left[\lambda I+A^v{\left(A^v\right)}^T+\alpha L_G{A}^v{\left(A^v\right)}^T\right]}^{-1}{X}^v,n<l.\hfill \end{array}\right.$$

(16)

After solving for $W^v$, the reconstruction errors of all samples within the view can be obtained via Equation (17). For normal traffic data, MOCBLSAE achieves relatively small reconstruction errors by encoding and reconstructing the data while incorporating their cluster relationships. In contrast, since MOCBLSAE does not learn the reconstruction features of network intrusion data, it typically yields larger reconstruction errors. Based on this idea, the top $n\delta (\delta \in [0,1\left]\right)$ largest training reconstruction error is selected as the threshold $T^v$. When the reconstruction error of unknown traffic data exceeds this threshold, MOCBLSAE identifies it as anomalous. The specific formula is given below:

$$Err\left(x^v\right)=\left|\right|x^v-A^v\left(x^v\right)W^v{\left|\right|}_2^2,$$

(17)

$$L^v\left(x_t^v\right)=\left\{\begin{array}{cc}\hfill & 1\left(\mathrm{normal}\right),\mathrm{if}Err\left(x^v\right)\le T^v,\hfill \\ \hfill & -1\left(\mathrm{intrusion}\right),\mathrm{otherwise},\hfill \end{array}\right.$$

(18)

where $Err\left(x^v\right)$ is the reconstruction error of $x^v$, $A^v\left(x^v\right)$ is the output of the hidden layer, and $L^v\left(x_t^v\right)$ is the view-specific predicted label of testing data $x_t^v$.

Finally, the intrusion detection framework based on the multi-view cluster structure guided one-class BLS-autoencoder (IDF-MOCBLSAE) is constructed as shown in Figure 2. In the training stage, IDF-MOCBLSAE captures the cross-view cluster structure by applying the ensemble clustering and the multi-view co-association matrix optimization. Then, MOCBLSAE is trained in each view to learn the discriminative patterns of normal traffic data by preserving the cross-view clustering structure while minimizing the intra-view sample reconstruction errors. After training, an ensemble decision pool consisting of multiple MOCBLSAE models is obtained. In the testing stage, for multi-view traffic data, IDF-MOCBLSAE can operate independently within individual views or perform cross-view ensemble decision-making (e.g.,, majority voting or one-vote veto strategies), enabling efficient and flexible identification of unknown network intrusion. The overall pseudo-code of the intrusion detection framework based on MOCBLSAE is demonstrated in Algorithm 2.

Algorithm 2 Intrusion detection based on multi-view cluster structure guided one-class BLS-autoencoder (IDF-MOCBLSAE)

Require:  Input: Multi-view training set $X=\{X^1,\dots ,X^V\}$, parameters $\lambda ,\alpha ,\delta$, multi-view testing sample $x_t=\{x_t^1,\dots ,x_t^V\}$. Ensure:  # Training stage 1: Compute the multi-view co-association matrix G according to Algorithm 1; 2: for each view $v=1$ to V do 3:     Construct the hidden layer $A^v$ according to Equations (10)–(12); 4:     Compute the connecting matrix $W^v$ according to Equation (16); 5:     Compute the reconstruction error of all training samples according to Equation (17), and set the threshold $T^v$ by the top $n\delta (\delta \in [0,1\left]\right)$ largest error; 6: end for # Testing stage 7: for each view $v=1$ to V do 8:     Compute the reconstruction error of $x_t^v$ according to Equation (17); 9:     Compute the view-specific predicted label $L^v\left(x_t^v\right)$ according to Equation (18); 10: end for 11: Obtain the prediction result of $L\left(x_t\right)$ based on the one-vote veto strategie. Output: The prediction result of $x_t$.

4. Experiments

4.1. Datasets and Experimental Setup

To validate the effectiveness of IDF-MOCBLSAE, this section constructs 10 multi-view one-class intrusion detection tasks based on two real-world network traffic datasets (i.e., KDD [33] and UNSW [34]).

Table 1. Multi-view one-class intrusion detection tasks based on two network traffic datasets.

Task	Intrusion Type	${\mathit{n}}_{\mathbf{train}}$	${\mathit{n}}_{\mathbf{test}}$ (Normal + Intrusion)	Dimensions of Each View
KDD1	Warezclient	20,000	20,000 + 890	{20, 21}
KDD2	Portsweep	20,000	20,000 + 2931	{20, 21}
KDD3	Teardrop	20,000	20,000 + 892	{20, 21}
KDD4	Nmap	20,000	20,000 + 1493	{20, 21}
KDD5	Pod	20,000	20,000 + 201	{20, 21}
UNSW1	Reconnaissance	18,500	18,500 + 3496	{21, 21}
UNSW2	DoS	18,500	18,500 + 4089	{21, 21}
UNSW3	Exploits	18,500	18,500 + 11,132	{21, 21}
UNSW4	Fuzzers	18,500	18,500 + 6062	{21, 21}
UNSW5	Generic	18,500	18,500 + 18,871	{21, 21}

presents the basic information of each task, where the training set consists of normal data, with $n_{train}$ denoting the number of training samples, and the testing set comprises both normal and intrusion data, with $n_{test}$ indicating the number of testing samples. For each task, the original feature space is randomly partitioned into two disjoint views and provides the corresponding number of features for each view.

In the experiments performed, the one-vote veto strategy is used in IDF-MOCBLSAE. All methods are executed 20 times, and their average accuracy and F1-score metrics, as shown in Equations (19) and (20) and

Table 2. Confusion matrix.

Actual Class	Predicted Class
	Intrusion (Positive)	Normal (Negative)
Intrusion (Positive)	TP	FN
Normal (Negative)	FP	TN

, are reported to comprehensively evaluate the performance.

$$\mathrm{Accuracy}={\displaystyle \frac{TP+TN}{TP+TN+FP+FN}},$$

(19)

$$\mathrm{F}1-\mathrm{score}={\displaystyle \frac{2PR}{P+R}},P={\displaystyle \frac{TP}{TP+FP}},R={\displaystyle \frac{TP}{TP+FN}}.$$

(20)

4.2. Comparison of OCC Methods

In this experiment, IDF-MOCBLSAE is compared with several state-of-the-art OCC methods, including the stacked one-class broad learning system (ST-OCBLS) [12], multilayer one-class extreme learning machine (ML-OCELM) [10], deep one-class classification based on SVDD (DeepSVDD) [35], outlier analysis based on deep autoencoder (DeepAE) [36], and the Hybrid Ensemble Broad Learning System (SMC-OCBLS) [11]. Among them, ST-OCBLS is a stacked autoencoder variant of OCBLS, enhancing detection efficiency and accuracy through hierarchical feature learning. ML-OCELM, another stacked AE-based extension of OCELM, leverages the integration of deep autoencoders and kernel learning frameworks to improve performance on complex data and multi-class classification tasks. Deep-SVDD, on the other hand, is a deep neural network adaptation of SVDD [18], designed to strengthen its applicability as a one-class classifier. DeepAE employs a deeper architecture to enhance learning of the features for OCC tasks. SMC-OCBLS is a one-class BLS network with a maximum correntropy and boosting scheme to improve the performance. All views are concatenated into a complete feature space and the comparative OCC methods are directly applied for intrusion detection.

The comparison results in terms of accuracy and F1-score are shown in

Table 3. The comparison results in terms of accuracy where the bold values indicate the best performance.

Task	IDF-MOCBLSAE	SMC-OCBLS	ST-OCBLS	ML-OCELM	DeepAE	DeepSVDD
KDD1	0.9552	0.8804	0.8018	0.7624	0.5799	0.6261
KDD2	0.8711	0.9478	0.9326	0.8425	0.9601	0.8801
KDD3	0.9525	0.8964	0.8873	0.9143	0.3616	0.7525
KDD4	0.9381	0.9181	0.8891	0.7691	0.4234	0.604
KDD5	0.8858	0.8001	0.7682	0.8119	0.4728	0.7921
UNSW1	0.8482	0.8481	0.8415	0.8456	0.7699	0.7774
UNSW2	0.9223	0.9455	0.9303	0.9224	0.8559	0.8681
UNSW3	0.7139	0.8639	0.8531	0.7451	0.6817	0.7326
UNSW4	0.8146	0.8108	0.8023	0.7868	0.7489	0.7545
UNSW5	0.8881	0.9831	0.9404	0.7614	0.8328	0.7433

and

Table 4. The comparison results in terms of F1-score where the bold values indicate the best performance.

Task	IDF-MOCBLSAE	SMC-OCBLS	ST-OCBLS	ML-OCELM	DeepAE	DeepSVDD
KDD1	0.9771	0.9163	0.8531	0.7993	0.5726	0.9163
KDD2	0.9309	0.9623	0.9515	0.8671	0.9707	0.9623
KDD3	0.9757	0.9281	0.9221	0.9384	0.1691	0.9281
KDD4	0.9676	0.9419	0.9205	0.7883	0.3019	0.9419
KDD5	0.9428	0.8694	0.8515	0.8759	0.3945	0.8694
UNSW1	0.3121	0.2221	0.2306	0.1552	0.1102	0.2221
UNSW2	0.8987	0.8357	0.7889	0.7643	0.3425	0.8357
UNSW3	0.7679	0.7856	0.7677	0.4965	0.4319	0.5493
UNSW4	0.4784	0.4252	0.4101	0.2761	0.3602	0.3824
UNSW5	0.8581	0.9831	0.9375	0.6581	0.8226	0.6898

, respectively, with the best-performing results highlighted in bold. It can be observed that IDF-MOCBLSAE achieves superior performance on 6 out of 10 tasks in terms of accuracy and 7 out of 10 tasks in terms of the F1-score. This performance advantage can be attributed to two key factors: (1) Existing state-of-the-art OCC methods simply concatenate multi-view features without effective collaborative learning mechanisms; (2) IDF-MOCBLSAE enhances overall detection performance by simultaneously preserving the inter-view cluster structures while minimizing intra-view reconstruction errors.

4.3. Parameter Sensitivity Analysis

This subsection systematically examines the effect of parameters $\alpha$ and $\lambda$, which control the trade-off importance of preserving the cross-view cluster structure and the Frobenius norm, respectively. Through controlled experimentation that involves independently modulating each parameter while maintaining others fixed, our sensitivity analysis reveals parameter-dependent performance variations as illustrated in Figure 3. A grid search is conducted for both parameters within the range $[0.001,1.0]$, with red color indicating better performance in terms of accuracy. It can be observed that IDF-MOCBLSAE demonstrates better robustness to the selection of $\lambda$. As for $\alpha$, IDF-MOCBLSAE maintains better performance when $\alpha <0.05$, and the performance decreases when $\alpha$ increases. The possible reason is that applying the excessive constraint of preserving the cross-view cluster structure may affect the learning process of sample reconstruction. In conclusion, the recommended parameter settings are $\alpha \in [0.001,0.05]$ and $\lambda \in [0.01,0.5]$.

4.4. Ablation Analysis

In this paper, the multi-view co-association matrix optimization objective function with doubly-stochastic constraints is proposed in Equation (4) to capture a higher quality cross-view cluster structure. Furthermore, MOCBLSAE is improved by preserving the cross-view clustering structure while minimizing the intra-view sample reconstruction errors. To verify the effectiveness of the components of IDF-MOCBLSAE, IDF-MOCBLSAE is compared with two methods: OCBLSAE removes the third term of cluster structure preserving in Equation (13); MOCBLSAE-G simply computes $G={\displaystyle \frac{1}{V}}{G}^v$ instead of solving problem (4). The experimental results in terms of accuracy and F1-score are shown in Figure 4 and Figure 5, respectively. According to the experimental results, IDF-MOCBLSAE has an overall better performance than OCBLSAE and MOCBLSAE-G, which demonstrates the effectiveness of the cross-view cluster structure guidance in MOCBLSAE and the optimization of the multi-view co-association matrix.

4.5. Time Efficiency Analysis

To evaluate the training efficiency of different OCC methods, this section conducts model training on the KDD dataset using varying amounts of normal traffic data ranging from 2500 to 20,000 samples and recording the corresponding time consumption. The experimental results are shown in Figure 6 where the red line represents the running time of IDF-MOCBLSAE. As can be observed, deep learning-based OCC approaches (DeepAE and DeepSVDD) exhibit a significant increase in time consumption as the sample size grows, while flat-structured network-based OCC approaches demonstrate superior training efficiency.

Figure 4. Ablation experiment in terms of accuracy.

Figure 4. Ablation experiment in terms of accuracy.

Figure 5. Ablation experiment in terms of F1-score.

Figure 5. Ablation experiment in terms of F1-score.

Figure 6. Time complexity of different OCC methods.

Figure 6. Time complexity of different OCC methods.

5. Conclusions

With the growing prevalence of network traffic data sharing across multiple sources, cybersecurity has become a critical priority. This paper proposes an intrusion detection framework based on a multi-view cluster structure guided one-class BLS-autoencoder (IDF-MOCBLSAE). A multi-view co-association matrix optimization objective function with doubly-stochastic constraints is first designed to combine view-specific spectral embeddings from ensemble partitions and better captures the underlying cluster structure across different views. Then, a multi-view cluster structure guided one-class BLS-autoencoder (MOCBLSAE) is proposed, which learns discriminative patterns of normal traffic data by preserving the cross-view clustering structure while minimizing the intra-view sample reconstruction errors. Finally, the intrusion detection framework is constructed based on multiple MOCBLSAEs to achieve both individual and ensemble intrusion detection. In the application, IDF-MOCBLSAE is deployed on the data analysis node of IDS. During the training phase, it collects multi-view normal network traffic data from multiple sources and trains MOCBLSAE models for each view. In the detection phase, each view-specific datum can be independently predicted using the corresponding MOCBLSAE model, without collecting data from all sources. In addition, to achieve a more comprehensive decision-making process, multiple view-specific prediction results can be integrated into the ensemble prediction by majority voting or one-vote veto strategies.

To demonstrate the effectiveness of the proposed method, this paper conducts a series of experiments and analyzes the results: (1) IDF-MOCBLSAE is compared with state-of-the-art OCC methods. The experimental results show that IDF-MOCBLSAE achieves overall superior performance to the comparison methods. (2) The effects of two trade-off parameters in IDF-MOCBLSAE are analyzed, and the recommended parameter settings are provided. (3) The ablation analysis on IDF-MOCBLSAE is presented, which demonstrates the effectiveness of the cross-view cluster structure guidance in MOCBLSAE and the optimization of the multi-view co-association matrix. (4) The training efficiency of IDF-MOCBLSAE and the comparison OCC methods is evaluated. The experimental results show that IDF-MOCBLSAE can achieve better intrusion detection performance with training efficiency similar to state-of-the-art OCC methods.

The limitations of the proposed method include the following: (1) The detection performance for high-dimensional noisy traffic data still needs further improvement. (2) The training process of IDF-MOCBLSAE is centralized, lacking an online learning mechanism for data streaming. Therefore, the future research directions are summarized as follows: (1) Incorporating attention mechanisms, feature attribution methods, or visualization clustering to identify discriminative features or views. (2) Exploring asynchronous incremental learning techniques for multi-view OCC models by integrating continual learning paradigms, enhancing adaptability to evolving threats.