Hubble: An End to End Approach for Anomaly Detection in Network Traffic

Abstract

Fast and accurate detection of abnormal network traffic is of great significance to improve the stability and security of the network. In recent years, the research on anomaly detection of network traffic based on deep neural network has made substantial progress. However, existing network traffic anomaly detection methods mainly focus on learning new feature representations to anomaly detection methods, lead to data-inefficient learning and suboptimal anomaly scoring. Furthermore, they are typically designed as unsupervised learning methods due to the lack of large-scale labeled anomaly data. As a result, they are difficult to leverage the prior knowledge when such information is available as in many real-world anomaly detection applications. To tackle the aforementioned fundamental challenges, in this paper we introduce Hubble, a end to end anomaly detection framework for efficiently, accurately, and quickly detecting the abnormal information embedded in network traffic data. There are three key components combined to successfully achieve the above objectives, the feature extractor for fast traffic encoding learning, the anomaly scorer for accurate detection anomaly data, and the multi- classifier for diverse abnormal types. The extensive results show that Hubble can be trained substantially improving abnormal detection accuracy by 25.1% and reducing detection time up to 44.6% on average compared to state-of-the-art methods in network traffic.