Malware Detection in Network Flows With Self-Supervised Deep Learning

Abstract

This article explores the application of anomaly detection models from network flow data using multi-layer perceptron autoencoding neural networks, for the purpose of self-supervised detection of novel network intrusion events and malware classes over unrestrained internet connections. The authors utilized network flows rather than more detailed (and larger) packet capture logs in order to create a more cost-effective and potentially faster anomaly detection tool that could more easily scale enterprise class network traffic analysis. Unsupervised/self-supervised deep learning anomaly detection was used against this less-granular dataset to maximize the likelihood of detecting novel network activities within the less-detailed dataset without relying on pre-defined rules and training data. The authors conclude with a test of statistical significance against known threat classes (unknown to the anomaly detection model) that the proposed methodology results were statistically significant for detecting threat classes in unrestrained internet networks using network flow data.