An Empirical Evaluation of Deep Learning for Network Anomaly Detection

Abstract

Deep learning has been widely studied in many technical domains such as image analysis and speech recognition, with its benefits that effectively deal with complex and high-dimensional data.Our preliminary experiments show a high degree of non-linearity from the network connection data, which explains why it is hard to improve the performance of identifying network anomalies by using conventional learning methods (e.g., Adaboosting, SVM, and Random Forest). In this study, we design and examine deep learning models constructed based on Fully Connected Networks (FCNs), Variational AutoEncoder (VAE), and Sequence-to-Sequence (Seq2Seq) structures. For the extensive evaluation, we employ a broad range of the public datasets with unique characteristics. Our experimental results confirm the feasibility of deep learning-based network anomaly detection, with the improved performance compared to the conventional learning techniques. In particular, the detection model based on Seq2Seq with LSTM is highly promising, consistently yielding over 99% of accuracy to identify network anomalies from the entire datasets employed in the evaluation.

Intelligent Log Analysis for Anomaly Detection

“…LSTMs, on the other hand, is naturally able to capture relationships in sequences and have relatively stable accuracies over different hyperparameter choices as shown by [8]. Lastly, we confirmed the conclusion by [4] and [8] that, when it comes to LSTMs, a deeper model can achieve higher accuracies than a shallower model, but this is at the cost of increased training time.…”

“…There has been previous works using supervised approaches for anomaly detection involving the use of Logistic Regression, Decision Trees, or Neural Networks as binary classifiers to directly classify behaviors as normal or abnormal [3] [4]. However, these techniques require both normal and abnormal data points during training, which is often not a very practical requirement.…”

“…LSTM is a type of Recurrent Neural Network (RNN) that uses three multiplicative gates-input gate, output gate, and forget gate-to control gradient flow and alleviate the vanishing/exploding gradient problems encountered when training RNNs on long sequences. Previous works[4][8] have used deep-LSTM for log sequence modeling with promising results. Therefore, we built LSTM-based models as baseline for comparison.…”

Recent Advances in Anomaly Detection Methods Applied to Aviation

“…CNN-based anomaly detection methods have been mainly applied to intrusion detection [60,61] by preprocessing data samples with float and integer attributes into an image form convenient for CNN processing. In a more recent study, Kwon et al [62] assess several CNN architectures for anomaly detection using different network traffic datasets by comparing their performance to other techniques including Variational Autoencoders (VAE), Fully Connected Networks (FCN) [84] and LSTM. Their results indicate that CNN perform better than VAE, but worse than FCN and LSTM.…”

Long Short-Term Memory and Fuzzy Logic for Anomaly Detection and Mitigation in Software-Defined Network Environment

“…Usually, the Machine Learning techniques employed in anomaly detection systems are divided into two approaches: Shallow Learning and Deep Learning. Shallow Learning algorithms have some limitations, such as largely depending on attributes used in the process of training, and an intensive analysis is necessary in order to capture the most relevant attributes and statistics of the traffic [23], [24]. Besides, the models often need to be retrained to learn new patterns of network behavior [25], [26].…”