UNADA: Unsupervised Network Anomaly Detection Using Sub-space Outliers Ranking

Abstract

Abstract. Current network monitoring systems rely strongly on signature-based and supervised-learning-based detection methods to hunt out network attacks and anomalies. Despite being opposite in nature, both approaches share a common downside: they require the knowledge provided by an expert system, either in terms of anomaly signatures, or as normal-operation profiles. In a diametrically opposite perspective we introduce UNADA, an Unsupervised Network Anomaly Detection Algorithm for knowledge-independent detection of anomalous traffic. UNADA uses a novel clustering technique based on Sub-Space-Density clustering to identify clusters and outliers in multiple low-dimensional spaces. The evidence of traffic structure provided by these multiple clusterings is then combined to produce an abnormality ranking of traffic flows, using a correlation-distance-based approach. We evaluate the ability of UNADA to discover network attacks in real traffic without relying on signatures, learning, or labeled traffic. Additionally, we compare its performance against previous unsupervised detection methods using traffic from two different networks.

When YouTube Does not Work—Analysis of QoE-Relevant Degradation in Google CDN Traffic

“…The measurement approach followed in our work is currently being implemented within a more generic platform for automatic troubleshooting support. This platform is called mPlane: in the EU project mPlane 5 we are building a global Internet-scale measurement platform to better understand and diagnose performance degradation events in Internet-scale services such as YouTube, Facebook, Netflix, and others.…”

“…We use a simple auto-calibration approach to define the required inputs used by DBSCAN, similar to [5]. …”

A Near Real-Time Algorithm for Autonomous Identification and Characterization of Honeypot Attacks

“…UNADA (Unsupervised Network Anomaly detection Algorithm) [5] falls within the unsupervised anomaly detection domain, a novel research area that has drawn quite a lot of interest in the research community, but that still represents a rather immature field. Most work on unsupervised network anomaly detection has been devoted to the IDS field, generally targeting the detection of network intrusions in the very well known KDD'99 dataset.…”

Model-Based Outlier Detection System with Statistical Preprocessing

“…Commonly, the clustering approach is used with the similarity criteria such as distance-based, density-based, nearest-neighbor-based, etc. Casas, Mazel, and Owezarski (2011) proposed a network anomaly detection system using the unsupervised clustering approach by sub-space and density-based metrics to prevent the network attacks. The network attacks can be denial-ofservice, illegal access, probing, and spreading warms and viruses (Casas et al, 2011).…”

“…Casas, Mazel, and Owezarski (2011) proposed a network anomaly detection system using the unsupervised clustering approach by sub-space and density-based metrics to prevent the network attacks. The network attacks can be denial-ofservice, illegal access, probing, and spreading warms and viruses (Casas et al, 2011). In some cases, multiple-clustering techniques are combined for outlier detection using evidence accumulation (Fred & Jain, 2005).…”