An Unsupervised Deep Learning Model for Early Network Traffic Anomaly Detection

Abstract

Various attacks have emerged as the major threats to the success of a connected world like the Internet of Things (IoT), in which billions of devices interact with each other to facilitate human life. By exploiting the vulnerabilities of cheap and insecure devices such as IP cameras, an attacker can create hundreds of thousands of zombie devices and then launch massive volume attacks to take down any target. For example, in 2016, a record large-scale DDoS attack launched by millions of Mirai-injected IP cameras and smart printers blocked the accessibility of several high-profile websites. To date, the state-of-the-art defense systems against such attacks rely mostly on pre-defined features extracted from the entire flows or signatures. The feature definitions are manual, and it would be too late to block a malicious flow after extracting the flow features. In this work, we present an effective anomaly traffic detection mechanism, namely D-PACK, which consists of a Convolutional Neural Network (CNN) and an unsupervised deep learning model (e.g., Autoencoder) for auto-profiling the traffic patterns and filtering abnormal traffic. Notably, D-PACK inspects only the first few bytes of the first few packets in each flow for early detection. Our experimental results show that, by examining just the first two packets in each flow, D-PACK still performs with nearly 100% accuracy, while features an extremely low false-positive rate, e.g., 0.83%. The design can inspire the emerging efforts towards online anomaly detection systems that feature reducing the volume of processed packets and blocking malicious flows in time.

Deep Neural Network (DNN) Solution for Real-time Detection of Distributed Denial of Service (DDoS) Attacks in Software Defined Networks (SDNs)

“…Distributed service attack can be launched from different computers controlled by one command center [11]. A group of computers called zombies can be used to launch a DDoS attack on the SDN network [11]. No doubt SDN is a great networking architecture, however, DDoS attacks can bring the whole network down if the network is not secured.…”

Attack-Detection Architectural Framework Based on Anomalous Patterns of System Performance and Resource Utilization—Part II

“…The exploitation of ML algorithms in the field of cybersecurity is drawing many researchers in this direction, as it is taking security countermeasures to a new level. Concepts such as anomalybased detection, recognition strategies, and network traffic pattern analysis have been intensively discussed in many studies [24]- [28] . Therefore, adopting artificial intelligence (AI) concepts, and ML algorithms in particular, contribute to the development of innovative and effective security solutions that differ from known traditional solutions such as anti-virus software, firewalls, and encryption.…”

A Mean Convolutional Layer for Intrusion Detection System

“…To discriminate between normal and abnormal traffic, and to auto-profile traffic patterns, D-PACK has been proposed [9]. is approach integrates an unsupervised CNN model to investigate just the first few bytes of the first few packets in each flow, therefore detecting abnormal traffic early using raw packet-level data.…”

“…Two major gaps were seen during the literature review of anomaly detection problems. Firstly, there is a high falsealarm rate [8][9][10] for the methods used in anomaly detection. Secondly, training datasets were used in the training as well as the testing of models, employing cross-validation processes.…”