Manifold-Based Novelty Detection for Network Intrusion: A Contrastive Self-Supervised Approach

Traditional Network Intrusion Detection Systems (NIDS) struggle with novel, “zero-day” threats that bypass distribution-specific boundaries. This paper investigates an approach utilizing Contrastive Self-Supervised Learning (SSL) to learn representations of “normal” network traffic without labels. By optimizing an MLP encoder via the InfoNCE loss, we create a latent space that prioritizes structural invariants over statistical noise. Evaluating on the CIC-IDS2017 dataset using the Leave-One-Attack-Type-Out (LOATO) protocol, we analyze performance under strict operational constraints (TPR @ 1% FPR). Our findings show that while SSL provides a robust baseline for volumetric shifts compared to deterministic signatures, it remains sensitive to sparse point anomalies. We do not claim formal zero-day robustness guarantees, but provide an empirical evaluation of generalization behavior and suggest increased empirical difficulty under feature-level noise, without implying formal robustness guarantees.