Approaches for Anomaly Detection in Network: A Survey

Sawant, Anuja A.; Game, Pravin S.

doi:10.1109/iccubea.2018.8697557

Cited by 2 publications

(1 citation statement)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the field of anomaly detection, numerous papers provide insight into current anomaly detection methods, highlight their respective strengths and weaknesses, and address the prevailing challenges and research gaps in this field [ 8 , 32 , 33 , 34 , 35 ]. The recent study by Nassif et al [ 8 ] stands out as a comprehensive Systematic Literature Review (SLR) in the field of anomaly detection, aiming to summarize, clarify, and investigate the ML techniques and implementations applied in anomaly detection from 2000 to 2020.…”

Section: Related Workmentioning

confidence: 99%

Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection

Komadina,

Kovačević,

Štengl

et al. 2024

Sensors

View full text Add to dashboard Cite

Detecting anomalies in large networks is a major challenge. Nowadays, many studies rely on machine learning techniques to solve this problem. However, much of this research depends on synthetic or limited datasets and tends to use specialized machine learning methods to achieve good detection results. This study focuses on analyzing firewall logs from a large industrial control network and presents a novel method for generating anomalies that simulate real attacker actions within the network without the need for a dedicated testbed or installed security controls. To demonstrate that the proposed method is feasible and that the constructed logs behave as one would expect real-world logs to behave, different supervised and unsupervised learning models were compared using different feature subsets, feature construction methods, scaling methods, and aggregation levels. The experimental results show that unsupervised learning methods have difficulty in detecting the injected anomalies, suggesting that they can be seamlessly integrated into existing firewall logs. Conversely, the use of supervised learning methods showed significantly better performance compared to unsupervised approaches and a better suitability for use in real systems.

show abstract