Sequence Aggregation Rules for Anomaly Detection in Computer Network Traffic
We evaluate methods for applying unsupervised anomaly detection to cybersecurity applications on computer network traffic data, or flow. We borrow from the natural language processing literature and conceptualize flow as a sort of "language" spoken between machines. Five sequence aggregation rules are evaluated for their efficacy in flagging multiple attack types in a labeled flow dataset, CICIDS2017. For sequence modeling, we rely on long short-term memory (LSTM) recurrent neural networks (RNN). Additionally, a simple frequency-based model is described and its performance with respect to attack detection is compared to the LSTM models. We conclude that the frequency-based model tends to perform as well as or better than the LSTM models for the tasks at hand, with a few notable exceptions.
Code (0)
등록된 구현이 없습니다.
Tasks
Anomaly DetectionUnsupervised Anomaly DetectionMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
Online false discovery rate control for anomaly detection in time series
This article proposes novel rules for false discovery rate control (FDRC) geared towards online anomaly detection in time series. Online FDRC rules allow to control the properties of a sequence of statistical tests. In t…
Anomaly DetectionTime SeriesTime Series AnalysisFollow the Rules: Reasoning for Video Anomaly Detection with Large Language Models
Video Anomaly Detection (VAD) is crucial for applications such as security surveillance and autonomous driving. However, existing VAD methods provide little rationale behind detection, hindering public trust in real-worl…
Anomaly DetectionVideo Anomaly DetectionAnomaly Rule Detection in Sequence Data
Analyzing sequence data usually leads to the discovery of interesting patterns and then anomaly detection. In recent years, numerous frameworks and methods have been proposed to discover interesting patterns in sequence …
Anomaly DetectionOutlier DetectionLogGPT: Log Anomaly Detection via GPT
Detecting system anomalies based on log data is important for ensuring the security and reliability of computer systems. Recently, deep learning models have been widely used for log anomaly detection. The core idea is to…
Anomaly DetectionLanguage ModelingLanguage ModellingExplainable Deep Anomaly Detection with Sequential Hypothesis Testing for Robotic Sewer Inspection
Sewer pipe faults, such as leaks and blockages, can lead to severe consequences including groundwater contamination, property damage, and service disruption. Traditional inspection methods rely heavily on the manual revi…
Anomaly Detection