Deep embedded self-taught learning system and method for detecting suspicious network behaviours

A method for detecting potential malicious network activities in data traffic using a system comprising a data pre-processing module and an alert module communicatively connected to an output of the data pre-processing module, whereby the alert module comprises a trained autoencoder having a trained encoder with an output coupled to a trained classifier neural network, the method comprising:

• extracting, using the data pre-processing module, time-series features from a set of traffic data;
• tokenizing, using the data pre-processing module, categorical features from the extracted time-series features and embedding the tokenized features into corresponding dimensional embedding vectors;
• detecting and classifying, using the alert module, possible malicious network behaviour in the extracted time-series features and in the dimensional embedding vectors as obtained from the data pre-processing module,
• whereby the trained encoder comprises locked-in encodings associated with the trained autoencoder, and whereby the autoencoder is trained, using a bootstrapping method, based on time-series features that were extracted and processed from an entire training set of data traffic, whereby the processed time-series features comprise numerical features and dimensional embedding vectors generated from tokenized categorical features using the data pre-processing module, and
• whereby the classifier neural network is initialized using time-series labelled data provided as input to the trained data pre-processing module, wherein the initialized classifier neural network is subsequently trained using static labels for labelled data and dynamically generated labels for unlabelled data.