Abstract:Unknown cyber-attacks have appeared constantly. Several anomaly detection techniques based on semi-supervised learning have been proposed to detect these unknown cyber-attacks. Among them, the Denoising Auto-Encoder (DAE) scheme performs better than others in accuracy but is not good enough in precision. This paper proposes a novel two-stage deep learning structure for network flow anomaly detection by combining the models of Gate Recurrent Unit (GRU) and DAE. By using supervised anomaly detection with a selection mechanism to assist semi-supervised anomaly detection, the precision and accuracy of the anomaly detection system are improved. In the proposed structure, we first use the GRU model to analyze the network flow and then take the outcome from the Softmax function as a confidence score. When the score is more than or equal to the predefined confidence threshold, the GRU model outputs the flow as a positive result, no matter the flow is classified as normal or abnormal. When the score is less than the confidence threshold, GRU model outputs the flow as a negative result and passes the flow to DAE model for flow classification. DAE then determines a reconstruction error threshold by learning the pattern of normal flows. Accordingly, the flow is normal or abnormal depending on whether it is under or over the reconstruction error threshold. A comparative experiment is performed using NSL-KDD dataset as benchmark. The results revealed that the precision using the proposed scheme is 0.83% better than DAE. The accuracy using the proposed approach is 90.21%, which is better than Random Forest, Naïve Bayes, One-Dimensional Convolutional Neural Network, two-stage Auto-Encoder, etc. In addition, the proposed approach is also applied to the environment of software defined network (SDN). By adopting our approach in SDN environment, the precision and F-measure are significantly improved.

A Graph Construction Method for Anomalous Traffic Detection with Graph Neural Networks Using Sets of Flow Data

Anomaly traffic detection in IoT security using graph neural networks

Flow Topology-Based Graph Convolutional Network for Intrusion Detection in Label-Limited IoT Networks

GNN-Based Network Traffic Analysis for the Detection of Sequential Attacks in IoT

Unsupervised Abnormal Traffic Detection through Topological Flow Analysis

A Novel Two-Stage Deep Learning Structure for Network Flow Anomaly Detection

Flow Interaction Graph Analysis: Unknown Encrypted Malicious Traffic Detection

FlowGANAnomaly: Flow-Based Anomaly Network Intrusion Detection with Adversarial Learning

Few-Shot Learning-Based Malicious IoT Traffic Detection with Prototypical Graph Neural Networks

GNN-based Anomaly Detection for Encoded Network Traffic

GraphMal: A Network Malicious Traffic Identification Method Based on Graph Neural Network

Graph Neural Networks for Anomaly Detection in Industrial Internet of Things

Unsupervised Network Traffic Anomaly Detection Method Based on Attribute Graph in Power Internet of Things

Flow Graph Anomaly Detection Based on Unsupervised Learning

Local Augmentation with Functionality-Preservation for Semi-Supervised Graph Intrusion Detection

Graph-Augmented Normalizing Flows for Anomaly Detection of Multiple Time Series

Using Graph to Detect Network Traffic Anomaly

Graph-based Intrusion Detection System Using General Behavior Learning

Graph neural network-based anomaly detection for river network systems

Applying Self-supervised Learning to Network Intrusion Detection for Network Flows with Graph Neural Network

Deep Learning-Based Anomaly Detection in Network Traffic for Cyber Threat Identification