Network anomaly detection research: a survey

Kurniabudi, Kurniabudi; Purnama, Benni; Sharipuddin, Sharipuddin; Darmawijoyo, Darmawijoyo; Stiawan, Deris; Samsuryadi, Samsuryadi; Heryanto, Ahmad; Budiarto, Rahmat

doi:10.52549/ijeei.v7i1.773

Cited by 13 publications

(8 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the work by Kurniabudi et al [7], the Naive Bayes algorithm was used to develop a model for the identification of DDSA. The authors compared the performance of different algorithms for the identification of DDSA.…”

Section: Related Workmentioning

confidence: 99%

Evaluation of Bernoulli Naive Bayes model for detection of distributed denial of service attacks

Salau

Assegie²,

Akindadelo³

et al. 2023

Bulletin EEI

View full text Add to dashboard Cite

Distributed denial of service is a form of cyber-attack that involves sending several network traffic to a target system such as DHCP, domain name server (DNS), and HTTP server. The attack aims to exhaust computing resources such as memory and the processor of a target system by blocking the legitimate users from getting access to the service provided by the server. Network intrusion prevention ensures the security of a network and protects the server from such attacks. Thus, this paper presents a predicitive model that identifies distributed denial of service attacks (DDSA) using Bernoulli-Naive Bayes. The developed model is evaluated on the publicly available Kaggle dataset. The method is tested with a confusion matrix, receiver operating characteristics (ROC) curve, and accuracy to measure its performance. The experimental results show an 85.99% accuracy in detecting DDSA with the proposed method. Hence, Bernoulli-Naive Bayes-based method was found to be effective and significant for the protection of network servers from malicious attacks.

show abstract

Section: Related Workmentioning

confidence: 99%

Evaluation of Bernoulli Naive Bayes model for detection of distributed denial of service attacks

Salau

Assegie²,

Akindadelo³

et al. 2023

Bulletin EEI

View full text Add to dashboard Cite

show abstract

“…In the Spine-and-Leaf network, the number of switches at the top of the server rack increases with the number of servers. In the actual generation environment, the typical number of switches deployed is 45, and a single data sample contains the traffic collected by 45 switches [8]. The dimension of data characteristics is higher.…”

Section: Data Preprocessingmentioning

confidence: 99%

Network traffic anomaly detection method based on improved clustering analysis

Xu¹,

Liu²,

Zhang³

et al. 2023

International Conference on Signal Processing, Computer Networks, and Communications (SPCNC 2022)

View full text Add to dashboard Cite

With the surge in the amount of data transmitted on the network, intelligent learning and other technologies have emerged to solve the problem of anomaly detection of streaming data in large data. For network security issues, based on the extraction of network traffic characteristics, network traffic classification or clustering is an important technical means to discover network faults and network attacks. In this paper, a distributed detection framework for detecting anomalous behaviors of encrypted network traffic is proposed. The intelligent router is adopted to obtain the encrypted network traffic monitoring stub, and then the neural network codec is used to adaptively learn the characteristics of the encrypted traffic and identify the abnormal behavior of the encrypted protocol traffic. A wide coverage traffic pattern extraction algorithm based on the network state sequence is designed to obtain the traffic patterns that represent the network conditions of the data center. Finally, the simulation test verifies that the model has frequent traffic patterns with priority. The performance of the network anomaly detection model is better than other detection methods, which improves the accuracy of detection and has a better recognition effect.

show abstract

“…There are several basic dimensions for describing anomalies, including data type, the cardinality of the relationship, anomaly level, data structure, and data distribution [15]. A review of the literature shows that there are three different types of anomalies: 1-atomic uni-variate, 2-atomic multivariate, and 3-aggregate [16,17].…”

Section: Basic Conceptsmentioning

confidence: 99%

A Hybrid Recurrent Neural Network Approach for Detecting Abnormal User Behavior in Social Networks

Ebrahimzadeh

Nazari

Feizi‐Derakhshi

et al. 2023

Preprint

View full text Add to dashboard Cite

With the recent advances in Internet technology, various aspects of the human lifestyle are influenced by the digital world. Users join social networks to communicate and perform their social activities. In addition to the vast benefits, social networks may also negatively affect different dimensions of user activities. One of the major challenges in social networks is the security issues of the individual user activities since usually there is no mechanism to detect abnormal behavior of the users. On the other hand, due to the continuous expansion and dynamic nature of social networks, identifying anomalies and abnormal behaviors of users in such networks is of particular importance. The literature offers several methods to manage the challenge of the security breach of user activities in social networks. A thorough inspection of these methods shows that most of them focus on two important factors: selecting the appropriate feature and increasing the accuracy of detecting abnormal behaviors. The main innovation of this paper is the proposal of a new hybrid method based on recurrent neural networks to analyze the abnormal behavior of users and manage the two challenges mentioned above. Our motivation for using recurrent neural networks as the basis of the proposed method is the temporal nature of user activities in social networks and the reasonable performance of these methods in identifying abnormal behaviors, processing time-series data, and the ability to analyze relationships between them. In the proposed method, statistical methods are used for the initial labeling of data. In the next step, the CNN-BiLSTM hybrid method is applied to the data in order to re-label them, establish order between the features and thus reduce the error. Then the abnormal batches are identified using the K-means clustering algorithm. The experiments show that the proposed method provides more accurate results compared to other statistical and learning-based methods. The efficiency of the proposed method is also reported on the VAST Challenge 2008 and Enron-Email datasets for the F-score benchmark, 0.82 and 0.88, respectively.

show abstract

Network anomaly detection research: a survey

Cited by 13 publications

References 39 publications

Evaluation of Bernoulli Naive Bayes model for detection of distributed denial of service attacks

Evaluation of Bernoulli Naive Bayes model for detection of distributed denial of service attacks

Network traffic anomaly detection method based on improved clustering analysis

A Hybrid Recurrent Neural Network Approach for Detecting Abnormal User Behavior in Social Networks

Contact Info

Product

Resources

About