Network anomaly detection research: a survey

Kurniabudi, Kurniabudi; Purnama, Benni; Sharipuddin, Sharipuddin; Darmawijoyo, Darmawijoyo; Stiawan, Deris; Samsuryadi, Samsuryadi; Heryanto, Ahmad; Budiarto, Rahmat

doi:10.11591/ijeei.v7i1.773

Cited by 7 publications

(1 citation statement)

References 62 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Anomaly detection helps us to understand the unknown underlying phenomenon and enables us to rectify a potentially dangerous situation arising out of anomalies. Network anomaly detection refers to the problem of differentiating anomalous network flows and activities which can adversely impact the security of information systems [10][11][12]. As IT infrastructures of Oil and Gas organizations get increasingly complex with each passing day, these complexities introduce more and more bugs and vulnerabilities that may be exploited by adversaries to mount attacks.…”

Section: Introductionmentioning

confidence: 99%

Learning Representations of Network Traffic Using Deep Neural Networks for Network Anomaly Detection: A Perspective towards Oil and Gas IT Infrastructures

et al. 2020

View full text Add to dashboard Cite

Oil and Gas organizations are dependent on their IT infrastructure, which is a small part of their industrial automation infrastructure, to function effectively. The oil and gas (O&G) organizations industrial automation infrastructure landscape is complex. To perform focused and effective studies, Industrial systems infrastructure is divided into functional levels by The Instrumentation, Systems and Automation Society (ISA) Standard ANSI/ISA-95:2005. This research focuses on the ISA-95:2005 level-4 IT infrastructure to address network anomaly detection problem for ensuring the security and reliability of Oil and Gas resource planning, process planning and operations management. Anomaly detectors try to recognize patterns of anomalous behaviors from network traffic and their performance is heavily dependent on extraction time and quality of network traffic features or representations used to train the detector. Creating efficient representations from large volumes of network traffic to develop anomaly detection models is a time and resource intensive task. In this study we propose, implement and evaluate use of Deep learning to learn effective Network data representations from raw network traffic to develop data driven anomaly detection systems. Proposed methodology provides an automated and cost effective replacement of feature extraction which is otherwise a time and resource intensive task for developing data driven anomaly detectors. The ISCX-2012 dataset is used to represent ISA-95 level-4 network traffic because the O&G network traffic at this level is not much different than normal internet traffic. We trained four representation learning models using popular deep neural network architectures to extract deep representations from ISCX 2012 traffic flows. A total of sixty anomaly detectors were trained by authors using twelve conventional Machine Learning algorithms to compare the performance of aforementioned deep representations with that of a human-engineered handcrafted network data representation. The comparisons were performed using well known model evaluation parameters. Results showed that deep representations are a promising feature in engineering replacement to develop anomaly detection models for IT infrastructure security. In our future research, we intend to investigate the effectiveness of deep representations, extracted using ISA-95:2005 Level 2-3 traffic comprising of SCADA systems, for anomaly detection in critical O&G systems.

show abstract

Section: Introductionmentioning

confidence: 99%

Learning Representations of Network Traffic Using Deep Neural Networks for Network Anomaly Detection: A Perspective towards Oil and Gas IT Infrastructures

et al. 2020

View full text Add to dashboard Cite

show abstract

AE‐Integrated: Real‐time network intrusion detection with Apache Kafka and autoencoder

Roshan,

Zafar

2024

Concurrency and Computation

View full text Add to dashboard Cite

SummaryUnknown cyber‐attack detection in network traffic streams is challenging but crucial to ensure network security. It is observed that new security threats occur on a daily basis and make cyberspace vulnerable. In the literature, machine learning and deep learning‐based network intrusion detection systems have gained a lot of success but still face many challenges in detecting new security threats and unknown cyber‐attacks in real‐time. Additionally, high false alarm rates and real‐time detection in constantly evolving high‐dimensional network data streams are open issues for the research community. To address this issue, a DL‐based solution is developed to detect real‐time network anomalies in streaming data with high detection accuracy, precision, recall and low false negative and positive scenarios. The proposed novel algorithm, AE‐Integrated, is developed and evaluated on the latest CICIDS‐2017 dataset. The AE‐Integrated is updated with the newest network traffic data stream by the human administrator after a certain period to maintain its prediction accuracy for future inference. The simulation study is conducted with the Apache Kafka and Slack API to get real‐time anomaly alerts. Finally, we compared the result with recent state‐of‐the‐art research to evaluate the significance of the proposed algorithm. It is concluded that combining multiple lightweight autoencoders into a single large architecture provides optimal results. The accuracy, recall, and AUC of AE‐Integrated obtained are 99.54%, 99.53%, and 0.998, respectively.

show abstract

Outlier detection strategies for WSNs: A survey

Chander

Kumaravelan

2022

Journal of King Saud University - Computer and Information Scie

View full text Add to dashboard Cite

Network anomaly detection research: a survey

Cited by 7 publications

References 62 publications

Learning Representations of Network Traffic Using Deep Neural Networks for Network Anomaly Detection: A Perspective towards Oil and Gas IT Infrastructures

Learning Representations of Network Traffic Using Deep Neural Networks for Network Anomaly Detection: A Perspective towards Oil and Gas IT Infrastructures

AE‐Integrated: Real‐time network intrusion detection with Apache Kafka and autoencoder

Outlier detection strategies for WSNs: A survey

Contact Info

Product

Resources

About