Adaptive NAD: Online and Self-adaptive Unsupervised Network Anomaly Detector
The widespread usage of the Internet of Things (IoT) has raised the risks of cyber threats, thus developing Anomaly Detection Systems (ADSs) that can adapt to evolving or new attacks is critical. Previous studies primarily focused on offline unsupervised learning methods to safeguard ADSs, which is not applicable in practical real-world applications. Besides, most of them strongly rely on assumptions of known legitimates and fail to satisfy the interpretable requirements in security applications, creating barriers to the adoption in practice. In this paper, we design Adaptive NAD, a general framework to improve and interpret online unsupervised anomaly detection in security domains. An interpretable two-layer anomaly detection strategy is proposed to generate reliable high-confidence pseudo-labels. Then, an online learning scheme is introduced to update Adaptive NAD by a novel threshold calculation technique to adapt to new threats. Experimental results demonstrate that Adaptive NAD achieves more than 5.4%, 23.0%, and 3.2% improvements in SPAUC compared with state-of-the-art solutions on the CIC-Darknet2020, CIC-DoHBrw-2020, and Edge-IIoTset datasets, respectively. The code is released at https://github.com/MyLearnCodeSpace/Adaptive-NAD.
Code (1)
Tasks
Anomaly DetectionUnsupervised Anomaly DetectionSimilar Papers 제목 키워드 기반
Adaptive Memory Networks with Self-supervised Learning for Unsupervised Anomaly Detection
Unsupervised anomaly detection aims to build models to effectively detect unseen anomalies by only training on the normal data. Although previous reconstruction-based methods have made fruitful progress, their generaliza…
Anomaly DetectionDiversitySelf-Supervised LearningSleep Stage Detection+3ADALog: Adaptive Unsupervised Anomaly detection in Logs with Self-attention Masked Language Model
Modern software systems generate extensive heterogeneous log data with dynamic formats, fragmented event sequences, and varying temporal patterns, making anomaly detection both crucial and challenging. To address these c…
Anomaly DetectionLanguage ModelingLanguage ModellingLog Parsing+2Impact of Deep Learning Libraries on Online Adaptive Lightweight Time Series Anomaly Detection
Providing online adaptive lightweight time series anomaly detection without human intervention and domain knowledge is highly valuable. Several such anomaly detection approaches have been introduced in the past years, bu…
Anomaly DetectionDeep LearningTime SeriesTime Series Anomaly DetectionImproving log-based anomaly detection through learned adaptive filter
Log messages record important system runtime information and are useful for detecting anomalous behaviors and managing modern software systems. Many supervised and unsupervised learning methods have been proposed recentl…
Anomaly DetectionDeep Reinforcement LearningSubspace-Guided Feature Reconstruction for Unsupervised Anomaly Localization
Unsupervised anomaly localization, which plays a critical role in industrial manufacturing, aims to identify anomalous regions that deviate from normal sample patterns. Most recent methods perform feature matching or rec…
Anomaly Localization