Unsupervised Learning Model for Real-Time Anomaly Detection in Computer Networks

Abstract

SUMMARYDetecting a variety of anomalies caused by attacks or accidents in computer networks has been one of the real challenges for both researchers and network operators. An effective technique that could quickly and accurately detect a wide range of anomalies would be able to prevent serious consequences for system security or reliability. In this article, we characterize detection techniques on the basis of learning models and propose an unsupervised learning model for real-time anomaly detection in computer networks. We also conducted a series of experiments to examine capabilities of the proposed model by employing three well-known machine learning algorithms, namely multivariate normal distribution, knearest neighbor, and one-class support vector machine. The results of these experiments on real network traffic suggest that the proposed model is a promising solution and has a number of flexible capabilities to detect several types of anomalies in real time. key words: machine learning, multivariate normal distribution, nearest neighbor, one-class support vector machine

Improved KNN Algorithm for Fine-Grained Classification of Encrypted Network Flow

“…Machine learning is a well-known method in the field of encrypted traffic classification [8]. But the machine-learning method needs a great amount of labeled data to train a model in terms of achieving fine-grained classification [9], and it is difficult to realize in an actual network for the reasons that labeled data are hard to obtain [10] and the model should be updated periodically for coping with concept drift [11,12].…”

An Attention-Based GRU Network for Anomaly Detection from System Logs

“…In recent years, the issue of anomaly detection from system logs has been a research hotspot of anomaly detection field [1]. As unstructured data, system logs are closely combined with text mining, statistics, machine learning and other domains [9]. Existing approaches are proposed, such as PCA based approaches over log message counters [2], invariant mining based methods to capture co-occurrence patterns between different log keys [3], and workflow based methods to identify execution anomalies in program logic flows [4].…”