Unsupervised Anomaly Detection Approach for Cyberattack Identification

Segurola-Gil, Lander; Moreno-Moreno, Mikel; Irigoien, Itziar; Florez-Tapia, Ane Miren

doi:10.1007/s13042-024-02237-w

Int. J. Mach. Learn. & Cyber.

2024

DOI: 10.1007/s13042-024-02237-w

|View full text |Cite

Unsupervised Anomaly Detection Approach for Cyberattack Identification

Lander Segurola-Gil,

Mikel Moreno-Moreno,

Itziar Irigoien

et al.

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

Supporting

Mentioning

Contrasting

Year Published

2024

Publication Types

Select...

Article1

Relationship

Self Cite0

Independent1

Authors

Journals

Cited by 1 publication

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

Unsupervised Anomaly Detection and Explanation in Network Traffic with Transformers

Kummerow,

Abrha,

Eisenbach

et al. 2024

Electronics

View full text Add to dashboard Cite

Deep learning-based autoencoders represent a promising technology for use in network-based attack detection systems. They offer significant benefits in managing unknown network traces or novel attack signatures. Specifically, in the context of critical infrastructures, such as power supply systems, AI-based intrusion detection systems must meet stringent requirements concerning model accuracy and trustworthiness. For the intrusion response, the activation of suitable countermeasures can greatly benefit from additional transparency information (e.g., attack causes). Transformers represent the state of the art for learning from sequential data and provide important model insights through the widespread use of attention mechanisms. This paper introduces a two-stage transformer-based autoencoder for learning meaningful information from network traffic at the packet and sequence level. Based on this, we present a sequential attention weight perturbation method to explain benign and malicious network packets. We evaluate our method against benchmark models and expert-based explanations using the CIC-IDS-2017 benchmark dataset. The results show promising results in terms of detecting and explaining FTP and SSH brute-force attacks, highly outperforming the results of the benchmark model.

show abstract

Unsupervised Anomaly Detection and Explanation in Network Traffic with Transformers

Kummerow,

Abrha,

Eisenbach

et al. 2024

Electronics

View full text Add to dashboard Cite

show abstract

scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.

Contact Info

customersupport@researchsolutions.com

10624 S. Eastern Ave., Ste. A-614

Henderson, NV 89052, USA

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Blog Terms and Conditions API Terms Privacy Policy Contact Cookie Preferences Do Not Sell or Share My Personal Information

Made with 💙 for researchers

Part of the Research Solutions Family.

Unsupervised Anomaly Detection Approach for Cyberattack Identification

Cited by 1 publication

References 29 publications

Unsupervised Anomaly Detection and Explanation in Network Traffic with Transformers

Unsupervised Anomaly Detection and Explanation in Network Traffic with Transformers

Contact Info

Product

Resources

About