One-Class LSTM Network for Anomalous Network Traffic Detection

Abstract

Artificial intelligence-assisted security is an important field of research in relation to information security. One of the most important tasks is to distinguish between normal and abnormal network traffic (such as malicious or sudden traffic). Traffic data are usually extremely unbalanced, and this seriously hinders the detection of outliers. Therefore, the identification of outliers in unbalanced datasets has become a key issue. To help solve this challenge, there is increasing interest in focusing on one-class classification methods that train models based on the samples of a single given class. In this paper, long short-term memory (LSTM) is introduced into one-class classification, and one-class LSTM (OC-LSTM) is proposed based on the traditional one-class support vector machine (OC-SVM). In contrast with other hybrid deep learning methods based on auto-encoders, the proposed method is an end-to-end training network that uses a loss function such as the OC-SVM optimization objective for model training. A comprehensive experiment on three large complex network traffic datasets showed that this method is superior to the traditional shallow method and the most advanced deep method. Furthermore, the proposed method can provide an effective reference for anomaly detection research in the field of network security, especially for the application of one-class classification.

A Comprehensive Survey of Machine Learning Methods for Surveillance Videos Anomaly Detection

“…Anomalies Dataset AUC MIL [102] Temporal UCF [194], ShanghaiTech [130] 79.49% MIL [227] Behavioral XD-Violence [215] 82.17% MIL [195] Pint-based UCF [194], the Dataset [195] 75.41% MIL [118] Point-based the Dataset [118] 78.2% OCC [156] Behavioral UCSD Ped1 [120], Avenue [135], UMN [163] 78.30-88.60% OCC [121] Motion-based NSL-KDD, CIC-IDS2017, MAWILab 95.71-99.66%…”

Combining Security and Reliability of Critical Infrastructures: The Concept of Securability

“…One-class models have long been proven to be very efficient in circumstances where there is a need for the detection of both known and unknown (novel) attacks; the model must be robust to noise samples and where there is a lack of datasets that include attacks when training the model, all of the above being the standard situation for an ICS. The authors in [16] propose a new IDS that integrates long short-term memory principles into the one-class model and has been tested through extensive experiments on three complex network security data sets.…”