Unsupervised Anomaly Model Detects Zero-Day Cyberattacks With 96.8 Percent Accuracy

A newly developed anomaly detection framework named ZeroDayDetectAI has demonstrated that combining an ensemble of autoencoders with latent-space clustering can identify previously unseen cyberattacks in heterogeneous networks with high statistical precision. In empirical testing on the benchmark CIC-IDS2017 dataset where the Port Scan attack class was completely withheld from training, the core detection engine, designated ZeroCluster-Net, achieved an overall classification accuracy of 96.78 percent, a precision of 97.15 percent, a recall of 95.89 percent, an F1-score of 96.52 percent, and an Area Under the Receiver Operating Characteristic Curve of 0.97. Crucially for operational network security, the system maintained a low False Positive Rate of 2.4 percent. Published in Discover Computing by researchers Nagamani Uddamari and P. Sammulal, the framework operates under a label-assisted one-class anomaly detection paradigm that models purely benign network flows, flagging traffic that deviates from the learned normal distribution as a candidate zero-day incident.

The motivation behind this architecture stems from persistent operational vulnerabilities in legacy intrusion detection infrastructure, which relies heavily on predetermined attack signatures, explicit threat labels, and fixed decision boundaries. Conventional signature-based tools and supervised classifiers perform effectively against documented intrusions, but they struggle against polymorphic variants and novel zero-day exploits with unobserved behavioral signatures. Modern digital infrastructure—spanning cloud services, virtualized environments, and Internet of Things ecosystems—generates diverse traffic patterns where baseline behaviors shift continuously. While deep learning methods can learn hierarchical representations, supervised models demand ever-growing labeled attack sets. Unsupervised autoencoders and clustering algorithms often suffer from unstable anomaly scores, lack ensemble diversity, rely on rigid static thresholds, and lack clear explanation mechanisms. ZeroDayDetectAI addresses these bottlenecks by integrating complementary autoencoder ensembles, validation-weighted score fusion, and latent-space clustering into a unified anomaly detection workflow. This combination enables the system to discriminate between normal operational volatility and genuinely malicious network deviations.

To simulate zero-day conditions, the experimental validation utilized the CIC-IDS2017 dataset, which contains realistic enterprise network traffic spanning normal operations and six attack categories: Denial of Service, Port Scan, Bot, Infiltration, Web Attack, and Brute Force. The researchers assembled a processed subset containing 56,900 network-flow records, including 22,800 benign samples, 19,000 Denial of Service samples, 8,000 Port Scan flows, 2,800 Brute Force instances, 2,200 Web Attack entries, 2,000 Bot samples, and 100 Infiltration records. To enforce a strict zero-day protocol, the entire Port Scan category was withheld from model development. The 22,800 benign flows were divided into 18,240 development samples and 4,560 independent test samples in an 80:20 ratio. The final test set combined these 4,560 benign records with all 8,000 held-out Port Scan records. Continuous attributes underwent Z-score standardization, missing values were imputed with zero, and clustering-based sampling preserved rare traffic profiles without exposing the detector to the withheld attack class.

Feature engineering follows a sequential three-phase hybrid pipeline configured to eliminate redundancy, filter irrelevant attributes, and compress high-dimensional telemetry into compact representations. In the initial phase, Information Gain ranks raw flow attributes by assessing their ability to reduce entropy regarding the target label. This label-assisted calculation is conducted strictly offline on the development subset and explicitly excludes held-out Port Scan data, retaining the leading attributes that account for 95 percent of cumulative relevance. The second stage applies the Fast Correlation-Based Filter using Symmetrical Uncertainty to iteratively remove redundant features that exhibit a symmetrical uncertainty coefficient of 0.70 or higher. In the third phase, Kernel Principal Component Analysis with a radial basis function kernel projects the remaining non-redundant attributes into a twenty-dimensional nonlinear latent representation. By mapping data into higher-dimensional Hilbert spaces using an inverse feature count gamma parameter, the pipeline captures complex nonlinear relationships across network protocols that linear principal component analysis cannot resolve.

At the core of the anomaly detection engine, ZeroCluster-Net deploys an ensemble of three structurally distinct autoencoders trained exclusively on benign traffic to reconstruct normal network behavior. The researchers systematically introduced structural diversity across the ensemble to suppress correlated reconstruction errors. The first member, AE1, implements a symmetric architecture configured as 64-32-16-32-64 with a sixteen-dimensional latent space, a dropout rate of 0.10, an L2 regularization coefficient of 1e-5, and a random seed of 42. The second member, AE2, features a deeper 128-64-32-8-32-64-128 structure with an eight-dimensional latent bottleneck, a dropout rate of 0.20, an L2 penalty of 1e-4, and an initialization seed of 52. The third member, AE3, uses a compact 96-48-12-48-96 profile with a twelve-dimensional latent representation, a dropout rate of 0.15, an L2 coefficient of 5e-5, and a seed of 62. All three models employ ReLU activations, linear output layers, Mean Squared Error loss, and Adam optimization with early stopping.

Instead of evaluating anomaly status through a single reconstruction metric, ZeroCluster-Net integrates multi-view reconstruction error with geometric latent density modeling into a dual-evidence scoring framework. When an incoming network flow is processed, each autoencoder produces a reconstruction error quantified by Mean Squared Error across all input features. The individual errors are combined into a fused reconstruction score using validation-performance-based weights derived from the inverse of each model’s benign validation error, ensuring that higher-performing autoencoders exert greater influence. In parallel, a MiniBatchKMeans clustering module, fitted exclusively on benign latent representations using six clusters determined through silhouette analysis, computes the Euclidean distance from the sample to the nearest benign cluster centroid. The normalized fused reconstruction score and the normalized nearest-centroid distance are then combined using an equal weighting coefficient of alpha equal to 0.50. This composite anomaly score effectively captures both structural reconstruction fidelity and latent manifold proximity, preventing localized modeling errors from skewing final classification decisions.

Classification decisions are governed by an adaptive threshold calibration mechanism designed to maintain consistent false-positive suppression across shifting network traffic environments. To avoid arbitrary threshold selection, the framework calibrates the baseline decision boundary at the 99.5th percentile of composite anomaly scores computed exclusively across benign validation records. Network flows yielding composite scores at or below this threshold are categorized as benign, while instances exceeding the boundary are flagged as candidate anomalous flows or potential zero-day intrusions. When deployed in production environments, this adaptive threshold can be periodically recalibrated over a fixed sliding window of network traffic to accommodate natural variations in enterprise activity. To prevent adversarial contamination, the methodology enforces a strict validation safeguard: traffic flows that ZeroCluster-Net predicts as benign during inference are not automatically added to the calibration set. Instead, threshold updates depend strictly on independently verified benign traffic, ensuring that undetected low-volume attacks cannot contaminate the reference distribution and compromise detection reliability over time.

Empirical evaluation on the independent test partition confirms that ZeroCluster-Net provides superior anomaly discrimination compared to established baseline models. Evaluated on the 12,560-sample testing partition containing 4,560 benign records and 8,000 unseen Port Scan flows, the framework attained 96.78 percent accuracy, outperforming standard single Autoencoders at 93.64 percent, Isolation Forest at 92.51 percent, and One-Class Support Vector Machines at 90.42 percent. ZeroCluster-Net also produced the highest recall at 95.89 percent alongside a False Positive Rate of 2.4 percent, representing a 38.5 percent reduction compared to the single Autoencoder, a 50.0 percent reduction relative to Isolation Forest, and a 60.7 percent reduction versus One-Class SVM. Detailed class-wise analysis demonstrated that the model detected held-out Port Scan traffic with 91.8 percent precision, 93.7 percent recall, and an F1-score of 92.7 percent, while recognizing benign traffic with 96.4 percent precision and 94.9 percent recall. A binary confusion matrix confirmed that 94.9 percent of benign records and 93.7 percent of unseen attack flows were correctly identified.

To isolate the performance contributions of each architectural module, the authors conducted comprehensive ablation experiments by selectively disabling key components within ZeroCluster-Net. Disabling ensemble fusion caused the most severe overall degradation, reducing classification accuracy from 96.78 percent to 92.86 percent, precision to 90.58 percent, recall to 91.94 percent, F1-score to 91.25 percent, and escalating the False Positive Rate to 6.4 percent. Similarly, eliminating adaptive thresholding caused the False Positive Rate to surge from 2.4 percent to 6.2 percent, underscoring its vital role in preventing alert fatigue under varying anomaly distributions. Disabling the Fast Correlation-Based Filter dropped accuracy to 93.42 percent and F1-score to 91.91 percent due to overlapping decision boundaries from redundant attributes. Omitting Kernel Principal Component Analysis decreased accuracy to 94.15 percent and F1-score to 92.73 percent. These ablation findings demonstrate that ensemble fusion and adaptive thresholding together achieve nearly a 60 percent reduction in false alarms over single-autoencoder baselines.

To satisfy operational interpretability requirements in enterprise cybersecurity environments, ZeroDayDetectAI incorporates a surrogate XGBoost explanation module paired with Shapley Additive Explanations. Because deep autoencoders and clustering algorithms operate as black-box models, the framework trains an XGBoost classifier on input-output pairs generated by ZeroCluster-Net to imitate its decisions. By computing SHAP values based on cooperative game theory, the module quantifies the marginal contribution of each feature, providing global trend rankings across all flows and local feature attributions for individual alerts. Despite these validated empirical results, the authors acknowledge key limitations. The evaluation relied on an offline simulation within the CIC-IDS2017 dataset using a single held-out attack category, meaning generalizability across diverse networks and traffic distributions requires further verification. The feature ranking stage also utilized known attack labels, and the offline tests did not assess streaming throughput, memory consumption, or adversarial evasion. Future research directions include leave-one-attack-type-out validations, automated hyperparameter optimization, and privacy-preserving blockchain collaboration across federated network domains.

Subject of Research: Unsupervised ensemble autoencoder and clustering architecture for zero-day network cyberattack detection

Article Title: ZeroDayDetectAI for unsupervised ensemble autoencoder and clustering based detection of novel and zero day cyberattacks in heterogeneous networks

Article References: Uddamari, N., & Sammulal, P. (2026). ZeroDayDetectAI for unsupervised ensemble autoencoder and clustering based detection of novel and zero day cyberattacks in heterogeneous networks. Discover Computing, 29(1), Article 794. https://doi.org/10.1007/s10791-026-10662-4

Image Credits: AI Generated

DOI: 10.1007/s10791-026-10662-4

Keywords: ZeroDayDetectAI, ZeroCluster-Net, zero-day cyberattacks, unsupervised anomaly detection, ensemble autoencoders, latent-space clustering, MiniBatchKMeans, CIC-IDS2017, composite anomaly scoring, adaptive threshold calibration, Information Gain ranking, Fast Correlation-Based Filter, Kernel Principal Component Analysis, SHAP explanations, network intrusion detection, surrogate XGBoost model, false positive rate reduction