A Novel Model for Anomaly Detection in Network Traffic Based on Support Vector Machine and Clustering

Abstract

New vulnerabilities and ever-evolving network attacks pose great threats to today’s cyberspace security. Anomaly detection in network traffic is a promising and effective technique to enhance network security. In addition to traditional statistical analysis and rule-based detection techniques, machine learning models are introduced for intelligent detection of abnormal traffic data. In this paper, a novel model named SVM-C is proposed for the anomaly detection in network traffic. The URLs in the network traffic log are transformed into feature vectors via statistical laws and linear projection. The obtained feature vectors are fed into a support vector machine (SVM) classifier and classified as normal or abnormal. Based on the idea of SVM and clustering, we construct an optimization model to train the parameters of the feature extraction method and traffic classifier. Numerical tests indicate that the proposed model outperforms the state of the arts on all the tested datasets.

A Comparison Experiment of Binary Classification for Detecting the GTP Encapsulated IoT DDoS Traffics in 5G Network

“…Through the experiment, these previous work confirmed that their classifier was better than other existing ML-based classifiers while saving computational costs [13].…”

“…Ma et al [13] proposed an optimization model that adjusts the hyperparameters of Gaussian kernel SVM for anomaly detection in network traffic. The experiment was conducted with benign/malicious binary classification (for three datasets), which showed an accuracy of 99.98%.…”

“…Previous studies used optimized hyperparameters-applied ML for efficient DDoS attack detection in wired networks [12,[17][18]. Particularly, other studies [13][14][15][16] showed performance improvement in detection using optimized hyperparameters over the existing default models. However, hyperparameters of the single ML model were not analyzed in order to optimize to perform DDoS detection with ultra-low latency using ML in the 5G environment, so there was a limit to applying it to detection in the 5G core network.…”

“…Research to analyze attack detection performance by optimizing ML models in a wired network environment is being actively conducted [12][13][14][15][16][17][18]. In addition, other previous studies conducted attack detection studies using ML models in 5G networks [19][20][21][22].…”