Open Access
Open access
Applied Sciences (Switzerland), volume 12, issue 3, pages 1759

Combining Unsupervised Approaches for Near Real-Time Network Traffic Anomaly Detection

Francesco Carrera 1
Vincenzo Dentamaro 2
Stefano Galantucci 2
Andrea Iannacone 1
D. Impedovo 2
Donato Barbuzzi 2
Publication typeJournal Article
Publication date2022-02-08
scimago Q2
SJR0.508
CiteScore5.3
Impact factor2.5
ISSN20763417
Computer Science Applications
Process Chemistry and Technology
General Materials Science
Instrumentation
General Engineering
Fluid Flow and Transfer Processes
Abstract

The 0-day attack is a cyber-attack based on vulnerabilities that have not yet been published. The detection of anomalous traffic generated by such attacks is vital, as it can represent a critical problem, both in a technical and economic sense, for a smart enterprise as for any system largely dependent on technology. To predict this kind of attack, one solution can be to use unsupervised machine learning approaches, as they guarantee the detection of anomalies regardless of their prior knowledge. It is also essential to identify the anomalous and unknown behaviors that occur within a network in near real-time. Three different approaches have been proposed and benchmarked in exactly the same condition: Deep Autoencoding with GMM and Isolation Forest, Deep Autoencoder with Isolation Forest, and Memory Augmented Deep Autoencoder with Isolation Forest. These approaches are thus the result of combining different unsupervised algorithms. The results show that the addition of the Isolation Forest improves the accuracy values and increases the inference time, although this increase does not represent a relevant problematic factor. This paper also explains the features that the various models consider most important for classifying an event as an attack using the explainable artificial intelligence methodology called Shapley Additive Explanations (SHAP). Experiments were conducted on KDD99, NSL-KDD, and CIC-IDS2017 datasets.

Found 
Found 

Top-30

Journals

1
2
3
4
5
6
1
2
3
4
5
6

Publishers

2
4
6
8
10
12
14
2
4
6
8
10
12
14
  • We do not take into account publications without a DOI.
  • Statistics recalculated only for publications connected to researchers, organizations and labs registered on the platform.
  • Statistics recalculated weekly.

Are you a researcher?

Create a profile to get free access to personal recommendations for colleagues and new articles.
Share
Cite this
GOST | RIS | BibTex | MLA
Found error?