State of the Art Literature Review on Network Anomaly Detection

Abstract

As network attacks are evolving along with extreme growth in the amount of data that is present in networks, there is a significant need for faster and more effective anomaly detection methods. Even though current systems perform well when identifying known attacks, previously unknown attacks are still difficult to identify under occurrence. To emphasize, attacks that might have more than one ongoing attack vectors in one network at the same time, or also known as APT (Advanced Persistent Threat) attack, may be hardly notable since it masquerades itself as legitimate traffic. Furthermore, with the help of hiding functionality, this type of attack can even hide in a network for years. Additionally, the expected number of connected devices as well as the fast-paced development caused by the Internet of Things, raises huge risks in cyber security that must be dealt with accordingly. When considering all above-mentioned reasons, there is no doubt that there is plenty of room for more advanced methods in network anomaly detection hence more advanced statistical methods and machine learning based techniques have been proposed recently in detecting anomalies.

A Novel Method for Detecting APT Attacks by Using OODA Loop and Black Swan Theory

“…To detect these complex attacks, there are few issues that must be considered: i) dimension reduction and overlapping information may cause outliers to vanish and ii) taking into account earlier detected outliers from historical data. Our earlier research results [22,23] showed that deep learning methods have a high potential to resolve the considerations i) and ii). One concern is to locate sufficient amount of good quality network data, for executing training and benchmarking tests.…”

A Novel Deep Learning Stack for APT Detection

“…Current anomaly detection research [4,5] relies on similar methods, where outdated and heavily manipulated datasets, such as KDD98, KDDCUP99 and NSLKDD [6], are used for benchmarking proposed methods. Another issue is that complex problems are solved in a simple manner, that is, one type of method is used for handling the entire problem, such as one type or Machine Learning (ML) or Deep Learning (DL) algorithm.…”