Sequence Aggregation Rules for Anomaly Detection in Computer Network Traffic

Abstract

We evaluate methods for applying unsupervised anomaly detection to cybersecurity applications on computer network traffic data, or flow. We borrow from the natural language processing literature and conceptualize flow as a sort of "language" spoken between machines. Five sequence aggregation rules are evaluated for their efficacy in flagging multiple attack types in a labeled flow dataset, CICIDS2017. For sequence modeling, we rely on long short-term memory (LSTM) recurrent neural networks (RNN). Additionally, a simple frequency-based model is described and its performance with respect to attack detection is compared to the LSTM models. We conclude that the frequency-based model tends to perform as well as or better than the LSTM models for the tasks at hand, with a few notable exceptions.

arXiv commentPrepared for the American Statistical Associations Symposium on Data Science and Statistics 2018

References in corpus (2)

• Network Traffic Anomaly Detection Using Recurrent Neural Networks
• LSTM-Based System-Call Language Modeling and Robust Ensemble Method for Designing Host-Based Intrusion Detection Systems

Cited by in corpus (4)

• A Survey on Device Behavior Fingerprinting: Data Sources, Techniques, Application Scenarios, and Datasets
• Evaluation of Machine Learning Classifiers for Zero-Day Intrusion Detection -- An Analysis on CIC-AWS-2018 dataset
• On the Evaluation of Sequential Machine Learning for Network Intrusion Detection
• IoT-KEEPER: Securing IoT Communications in Edge Networks