HCAE-NIDS: A Hybrid Contrastive Autoencoder for Zero-Day Attack Detection

Abstract

Machine Learning has demonstrated state-of-the-art results in network intrusion detection; however, such methods struggle to detect zero-day attacks, posing a critical challenge to network security. Autoencoder based anomaly detection methods are widely adopted to address this limitation, but latent-space overgeneralization degrades overall performance. This paper proposes HCAE-NIDS that jointly optimizes reconstruction with similarity-based contrastive objectives, enforcing compactness in the normal latent space. Also, an adaptive percentile-based thresholding strategy is employed, dynamically adjusting the decision boundary as traffic patterns evolve. HCAE-NIDS is evaluated on the recently published GeNIS dataset, and the results show a significant improvement over the baselines AE, VAE, and DAE with 96.62% accuracy, 97.13% precision, 98.51% recall, 97.82% F1-score, and 98.31% AUROC. More importantly, the FPR is reduced to 9.57% as compared to 20% for all baselines, validating the potential for ever-evolving real-world deployment settings.