RPM-Net Reciprocal Point MLP Network for Unknown Network Security Threat Detection

Jiachen Zhang; Yueming Lu; Fan Feng; Zhanfeng Wang; Shengli Pan; Daoqi Han

cs.CRApr 8, 2026

RPM-Net Reciprocal Point MLP Network for Unknown Network Security Threat Detection

Authors: Jiachen Zhang, Yueming Lu, Fan Feng, Zhanfeng Wang, Shengli Pan, Daoqi Han

Organizations: School of Cyberspace Security, Beijing University of Posts and Telecommunications · Guangxi Key Laboratory of Digital Infrastructure, Guangxi Zhuang Autonomous Region Information Center

Abstract

Effective detection of unknown network security threats in multi-class imbalanced environments is critical for maintaining cyberspace security. Current methods focus on learning class representations but face challenges with unknown threat detection, class imbalance, and lack of interpretability, limiting their practical use. To address this, we propose RPM-Net, a novel framework that introduces reciprocal point mechanism to learn "non-class" representations for each known attack category, coupled with adversarial margin constraints that provide geometric interpretability for unknown threat detection. RPM-Net++ further enhances performance through Fisher discriminant regularization. Experimental results show that RPM-Net achieves superior performance across multiple metrics including F1-score, AUROC, and AUPR-OUT, significantly outperforming existing methods and offering practical value for real-world network security applications. Our code is available at:https://github.com/chiachen-chang/RPM-Net

Figures & tables

Figure 1: Illustration of open-set network threat detection.

Figure 2: RPM-Net architecture and training process: (1)The top section illustrates the complete workflow from network flow samples through the neural network to reciprocal point space classification. (2)The bottom section details the three core loss functions: Margin Loss ensures separation between known classes and their reciprocal points, Fisher Loss enhances intra-class compactness and inter-class separability, and Classification Loss optimizes class probability distributions. The distance discriminator uses reciprocal point distances to classify new samples and detect unknown threats.

Dataset	Method	Precision	Recall	F1-Score	AUROC	AUPR-IN	AUPR-OUT
CICIDS2017	Baseline	0.9996	0.9995	0.9996	0.7069	0.9732	0.1046
	EVM	0.9806	0.5538	0.6082	0.9600	0.9986	0.2974
	OCN	0.9946	0.9967	0.9956	0.9057	0.9968	0.2884
	ODIN	0.9966	0.9582	0.9765	0.7354	0.9726	0.1651
	RPM-Net	0.9987	0.9987	0.9987	0.9601	0.9989	0.6523
UNSW-NB15	Baseline	0.6626	0.5912	0.5473	0.7867	0.7928	0.7867

Table 1: Performance comparison on CICIDS2017 and UNSW-NB15 datasets. Precision, Recall, and F1-score are macro-averaged, and the best performance is marked in bold.

Dataset	Method	Precision	Recall	F1-Score	AUROC	AUPR-IN	AUPR-OUT
CICIDS2017	RPM-Net	$\mathbf{0.9987}$	$\mathbf{0.9987}$	$\mathbf{0.9987}$	0.9601	0.9989	0.6523
CICIDS2017	RPM - Net++	0.9981	0.9977	0.9979	$\mathbf{0.9735}$	0.9989	$\mathbf{0.6711}$
UNSW-NB15	RPM-Net	0.8022	0.8053	0.7950	0.8675	0.8511	0.8555
UNSW-NB15	RPM - Net++	$\mathbf{0.8043}$	$\mathbf{0.8072}$	$\mathbf{0.7955}$	$\mathbf{0.8850}$	$\mathbf{0.8913}$	$\mathbf{0.8664}$

Table 2: Ablation study: Impact of Fisher discriminant regularization, the best performance is marked in bold.

Figure 3: Average performance comparison across two datasets showing F1-Score, AUROC, and AUPR-OUT metrics for different methods.

Network Intrusion Detection

Network intrusion detection identifies malicious or abnormal network activity to help protect computers, connected devices, and critical infrastructure.

See all 168 papers

UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection
May 21, 2026Saif Alzubi, Frederic StahlNetwork Intrusion Detection Explainable Intrusion Detection
Department of Computer Science, University of Exeter, Exeter, UK · German Research Center for Artificial Intelligence GmbH (DFKI), Marine Perception, Marie-Curie-Straße 1, 26129 Oldenburg, Germany
Bridging the Closed-World Gap: Interpretable Anomaly Detection via a Hybrid TSK-FCM Ensemble on the BETH Dataset
Oct 22, 2026Lohith Srikanth Pentapalli, Josette Riep, Justin Ouwerkerk +1Anomaly Detection Interpretable Anomaly Detection
University of Cincinnati
Few-Shot Network Intrusion Detection Using Online Triplet Mining
May 17, 2026Jack Wilkie, Hanan Hindy, Christos Tachtatzis +2Network Intrusion Detection Few-Shot Learning
Department of Electronics and Electrical Engineering, University of Strathclyde, Glasgow G1 1XQ, UK · Faculty of Computer and Information Sciences, Ain Shams University, Cairo 11566, Egypt · Faculty of Electrical Engineering, Czech Technical University, 160 00 Prague, Czech Republic

May 21, 2026J/K move · Enter open · S save

UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection

Saif Alzubi, Frederic Stahl

Department of Computer Science, University of Exeter, Exeter, UK · German Research Center for Artificial Intelligence GmbH (DFKI), Marine Perception, Marie-Curie-Straße 1, 26129 Oldenburg, Germany

Network Intrusion Detection Explainable Intrusion Detection Unsupervised Anomaly Detection

Open paper AskPDF arXiv

The detection of previously unseen network attacks remains a major challenge for intrusion detection systems. Although supervised learning methods often perform well on known attack classes, they are limited when new attack types are not represented in the training data. Unsupervised methods are more suitable for detecting zero-day attacks, as they do not require labelled attack samples, but they often suffer from high false positive rates, which limits their real-world usefulness. This paper presents UNAD+, an enhanced framework for unknown network attack detection derived from the previously proposed Unknown Network Attack Detector (UNAD). UNAD+ combines a benign-only unsupervised ensemble with Weighted Majority Voting (WMV), a supervised refinement stage trained on pseudo-labelled detections, and a post hoc explainability layer that provides both local and global explanations. The framework was evaluated on the CICIDS2017 and NSL-KDD benchmark datasets. The results show that UNAD+ improves on the original UNAD framework, achieving F1-scores above 98% across the benchmark datasets while significantly reducing false positives and enhancing transparency and deployment suitability through integrated explainability.

Abstract

Network Intrusion Detection

Explore similar work

UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection

Bridging the Closed-World Gap: Interpretable Anomaly Detection via a Hybrid TSK-FCM Ensemble on the BETH Dataset

Few-Shot Network Intrusion Detection Using Online Triplet Mining