Network Traffic Anomaly Detection Research Articles

A Multi-Scale Temporal Feature Extraction Approach for Network Traffic Anomaly Detection

With the rapid advancement of network technology and the expanding scale of the Internet, network traffic data has grown exponentially, leading to increasingly prominent issues in network security. Many researchers are developing new network traffic anomaly detection models, but these models are difficult to effectively capture the multi-scale temporal characteristics of network traffic data and learn the correlation and importance among various feature dimensions. To this end, we propose a multi-scale temporal feature network (MSTFN-AM) based on an attention mechanism. MSTFN-AM integrates original data with temporal information through the temporal position encoding module and extracts multi-scale temporal features through the temporal feature extraction module. The temporal self-attention module can effectively identify dependencies and correlations between different time points. Ultimately, experiments conducted on two public datasets demonstrate that the MSTFN-AM model outperforms all baseline models in prediction performance.

Network Traffic Anomaly Detection Based on Spatiotemporal Feature Extraction and Channel Attention

To overcome the challenges of feature selection in traditional machine learning and enhance the accuracy of deep learning methods for anomaly traffic detection, we propose a novel method called DCGCANet. This model integrates dilated convolution, a GRU, and a Channel Attention Network, effectively combining dilated convolutional structures with GRUs to extract both temporal and spatial features for identifying anomalous patterns in network traffic. The one-dimensional dilated convolution (DC-1D) structure is designed to expand the receptive field, allowing for comprehensive traffic feature extraction while minimizing information loss typically caused by pooling operations. The DC structure captures spatial dependencies in the data, while the GRU processes time series data to capture dynamic traffic changes. Furthermore, the channel attention (CA) module assigns importance-based weights to features in different channels, enhancing the model’s representational capacity and improving its ability to detect abnormal traffic. DCGCANet achieved an accuracy rate of 99.6% on the CIC-IDS-2017 dataset, outperforming other algorithms. Additionally, the model attained precision, recall, and F1 score rates of 99%. The generalization capability of DCGCANet was validated on a subset of CIC-IDS-2017, demonstrating superior detection performance and robust generalization potential.

Detection and analysis of cellular network traffic anomalies and SMS spammers

The unfolding usage of mobile users inclusive of both 4G and 5G creates huge accumulation of data in cellular network. The network service providers need to ensure proper management of resource in terms of uninterrupted service with cost-effectiveness. The detection of cellular traffic and Short Message Service (SMS) spammers is very challenging. In this paper a novel method is proposed to analyse and detect the traffic anomalies and SMS spammers. To achieve this, Call Detail Record (CDR) issued by service provider is used. The CDR is pre-processed to convert into machine understandable format using mean-normalization technique. K-means clustering elbow method proves to be the best tool in identifying the traffic clusters in the network that detects both high and low traffic in the network. The novelty of the proposed work is the detection of low traffic clusters which usually is misled as sleeping cell or cell outage. The paper also presents a model designed to predict whether the message is spam SMS or ham SMS. The proposed model is suitable to run different classifiers like Logistic Regression, Multi nominal Naive Bayes, Support Vector Machine (SVM), Random Forest Classifier. The model gives the highest accuracy rate of 98.277% with SVM in detecting SMS spam.

A Novel Split Learning-Based Consumer Electronics Network Traffic Anomaly Detection Framework for Smart City Environment

A Novel Split Learning-Based Consumer Electronics Network Traffic Anomaly Detection Framework for Smart City Environment

Network Traffic Anomaly Detection: A Revisiting to Gaussian Process and Sparse Representation

Network Traffic Anomaly Detection: A Revisiting to Gaussian Process and Sparse Representation

Enhanced Network Traffic Anomaly Detection: Integration of Tensor Eigenvector Centrality with Low-Rank Recovery Models

Enhanced Network Traffic Anomaly Detection: Integration of Tensor Eigenvector Centrality with Low-Rank Recovery Models

Analysis of Machine Learning Application in Campus Network Traffic Anomaly Detection

Abstract In this paper, machine learning algorithms are first utilized to extract features of campus network traffic, and then the multi-attention mechanism is introduced to fuse the massive features extracted at different scales. Unsupervised learning is used to propose a method for detecting network traffic anomalies, and simulation experiments are conducted to verify the model’s performance. The results show that the detection rates of machine learning algorithms are all above 80%, the false alarm rate basically stays below 10%. The machine algorithms have higher accuracy than other algorithms in network data flow anomaly detection. This study has important reference value for campus network security research and verifies the important role of machine learning algorithms in detecting anomalies in campus network traffic.

Enhancing Network Traffic Anomaly Detection: Leveraging Temporal Correlation Index in a Hybrid Framework

Enhancing Network Traffic Anomaly Detection: Leveraging Temporal Correlation Index in a Hybrid Framework

On-Line Network Traffic Anomaly Detection Based on Tensor Sketch

On-Line Network Traffic Anomaly Detection Based on Tensor Sketch

Network Traffic Anomaly Detection Model Based on Feature Reduction and Bidirectional LSTM Neural Network Optimization

Aiming at the problems of large data dimension, more redundant data, and low accuracy in network traffic anomaly detection, a network traffic anomaly detection model (FR-APPSO BiLSTM) based on feature reduction and bidirectional long short-term memory (LSTM) neural network optimization is proposed. First, the feature dimensions are divided by hierarchical clustering according to the similarity distance between data features, and the features with high correlation are divided into the same feature subset. Second, an automatic encoder is used to reduce each feature subset, eliminating redundant information, and reducing the computational complexity of the detection data. Then, a particle swarm optimization algorithm based on adaptive updating of variables and dynamic adjustment of parameters (APPSO) is proposed, which is used to optimize the parameters of the bidirectional LSTM neural network (BiLSTM). Finally, the optimized BiLSTM is used as a classifier to model network traffic anomaly detection using the reduced feature data. Experiments based on NSL-KDD, UNSW-NB15, and CICIDS-2017 datasets show that the proposed FR-APPSO-BiLSTM model can effectively reduce data features, improve the accuracy of detection, and the performance of network traffic anomaly detection.

Subspace-Based Anomaly Detection for Large-Scale Campus Network Traffic

With the continuous development of information technology and the continuous progress of traffic bandwidth, the types and methods of network attacks have become more complex, posing a great threat to the large-scale campus network environment. To solve this problem, a network traffic anomaly detection model based on subspace information entropy flow matrix and a subspace anomaly weight clustering network traffic anomaly detection model combined with density anomaly weight and clustering ideas are proposed. Under the two test sets of public dataset and collected campus network data information of a university, the detection performance of the proposed anomaly detection method is compared with other anomaly detection algorithm models. The results show that the proposed detection model is superior to other models in speed and accuracy under the open dataset. And the two traffic anomaly detection models proposed in the study can well complete the task of network traffic anomaly detection under the large-scale campus network environment.

Machine Learning Based Classification Model for Network Traffic Anomaly Detection

In current days, cloud environments are facing a huge challenge from the attackers in terms of various attacks thrown to the cloud service providers. In both industry and academics, the problem of detection and mitigation of DDoS attacks is now a challenging issue. Detecting Distributed Denial of Service (DDos) threats is mainly a classification problem that can be addressed using data mining, machine learning and deep learning techniques. DDoS attacks can occur in any of the seven-layer OSI model's network. Hence, detecting the DDoS attacks is an important task for cloud service providers to overcome dangerous attacks and loss incurred to stake holders and also the provider.

A Network Traffic Anomaly Detection Method Based on Gaussian Mixture Model

How can we learn the normal behavior of some communication processes and predict whether a single communication is under attack, with massive network traffic data representing the time costs of each stage in a single communication process? This paper introduces a statistical method for detecting network traffic anomalies using the Gaussian mixture model. There are two aspects to our contributions. First, we show how to learn the normal behavior of a communication process under the assumption that its time costs are generated from the Gaussian mixture model. Secondly, we show that with the learned Gaussian mixture model, we can predict whether a data point is under attack by computing the likelihood that the data point is drawn from the learned Gaussian distribution. The experimental results show that our method reached high accuracy in some cases, while in some other cases that are more complicated, the data point may have more factors and cannot be represented simply by only one Gaussian mixture model.

Identification of Network Traffic Intrusion Using Decision Tree

Network technology plays an increasingly important role in all aspects of social life. The Internet has brought a new round of industrial revolution and industrial upgrading. The arrival of the “Internet” era is accompanied by a large‐scale increase in network applications and the number of netizens. At the same time, the number and severity of cyberattacks continue to increase. Therefore, intrusion detection systems (IDSs) have become an important part of the current network security infrastructure in various industries. Anomaly detection of network traffic data is an effective method for network protection. In order to better realize the detection of network traffic anomalies, several algorithms have been successfully applied. Most of them come from artificial intelligence (AI), but there is a general problem of excessive model execution processing time and low detection rates. And through a lot of research, it is found that most models do not pay enough attention to the data processing in the early stage. Therefore, in this paper, we optimize the data normalization process through a series of experiments and combine the PCA feature selection method to propose an optimized MaxAbs‐DT classifier model. To train and measure the performance of the model, we used the NSL‐KDD dataset, which is the benchmark dataset for most network anomaly detection models. The experimental results show that MaxAbs‐DT outperforms other existing models and validates the effectiveness of the method. In addition, its execution time is greatly reduced compared to many models.

Intrusion Detection Scheme With Dimensionality Reduction in Next Generation Networks

Due to millions of heterogeneous physical nodes, multiple-vendor and multi-tenant domains, and technologies etc., 5G has greatly expanded the threat landscape. Particularly from the high rate of traffic and ultra-low latency requirement of applications in 5G networks, the detection of the network traffic anomalies in real-time is critical. The conventional security approaches lack compatibility with modern network designs and are not much effective in 5G settings. We propose a two-stage network traffic anomaly detection system compatible with ETSI-NFV standard 5G architecture. Our architecture consists of two modules, i.e., (a) Dimensionality Reduction to compress the sample size at the edge of 5G networks and (b) Deep Neural Network classifier (DNN) that detects traffic anomalies. We have conducted our experiments using OMNET++ and ETSI-NFV (OSM MANO) 5G orchestration real platform deployed on AWS cloud systems. We have used the UNSW-NB15 data set and have shown that at dimensionality reduction factor of 81% the detection accuracy obtained is 98%. The proposal is compared with other recent approaches to show the overall merit of the architecture.

RRCNN: Request Response-Based Convolutional Neural Network for ICS Network Traffic Anomaly Detection

RRCNN: Request Response-Based Convolutional Neural Network for ICS Network Traffic Anomaly Detection

Research on Network Traffic Anomaly Detection Method Based on Python

Abnormal traffic is the traffic that differs from the normal range of network services. Objective social and natural phenomena, network equipment failures on hardware, and man-made malicious attacks can all lead to abnormal network traffic. Python is a computer programming language that can realize cross-platform interaction, and it is also an object-oriented explanatory and interactive scripting language. Based on this, this paper studies the network traffic anomaly detection method based on Python. By sampling the data sets divided by each layer with different strategies, multiple balanced sub-data sets are obtained, and the feature selection fusion method proposed in the previous section is applied to each sub-data set to obtain the corresponding optimal feature subset, which is used to train multiple base classifiers to perform anomaly detection in this layer. The results show that Python-based network traffic anomaly detection method is superior to the traditional algorithm in accuracy and F1-Score.

Empirical Mode Decomposition-empowered Network Traffic Anomaly Detection for Secure Multipath TCP Communications

Empirical Mode Decomposition-empowered Network Traffic Anomaly Detection for Secure Multipath TCP Communications

Combining Unsupervised Approaches for Near Real-Time Network Traffic Anomaly Detection

The 0-day attack is a cyber-attack based on vulnerabilities that have not yet been published. The detection of anomalous traffic generated by such attacks is vital, as it can represent a critical problem, both in a technical and economic sense, for a smart enterprise as for any system largely dependent on technology. To predict this kind of attack, one solution can be to use unsupervised machine learning approaches, as they guarantee the detection of anomalies regardless of their prior knowledge. It is also essential to identify the anomalous and unknown behaviors that occur within a network in near real-time. Three different approaches have been proposed and benchmarked in exactly the same condition: Deep Autoencoding with GMM and Isolation Forest, Deep Autoencoder with Isolation Forest, and Memory Augmented Deep Autoencoder with Isolation Forest. These approaches are thus the result of combining different unsupervised algorithms. The results show that the addition of the Isolation Forest improves the accuracy values and increases the inference time, although this increase does not represent a relevant problematic factor. This paper also explains the features that the various models consider most important for classifying an event as an attack using the explainable artificial intelligence methodology called Shapley Additive Explanations (SHAP). Experiments were conducted on KDD99, NSL-KDD, and CIC-IDS2017 datasets.

Intrusion detection in internet of things networks based on machine learning methods

Introduction: The growing amount of digital data generated, among others, by smart devices of the Internet of Things makes it important to study the application of machine learning methods to the detection of network traffic anomalies, namely the presence of network attacks. Purpose: To propose a unified approach to detecting attacks at different levels of IoT network architecture, based on machine learning methods. Results: It was shown that at the wireless sensor network level, attack detection is associated with the detection of anomalous behavior of IoT devices, when the deviation of an IoT device behavior from its profile exceeds a predetermined level. Smart IoT devices are profiled on the basis of statistical characteristics, such as the intensity and duration of packet transmission, the proportion of retransmitted packets, etc. At the level of a local or global wired IoT network, data is aggregated and then analyzed using machine learning methods. Trained classifiers can become a part of a network attack detection system, making decisions about compromising a node on the fly. Models of classifiers of network attacks were experimentally selected both at the level of a wireless sensor network and at the level of a local or global wired network. The best results in terms of completeness and accuracy estimates are demonstrated by the random forest method for a wired local and/or global network and by all the considered methods for a wireless sensor network. Practical relevance: The proposed models of classifiers can be used for developing intrusion detection systems in IoT networks.