Abstract:Anomaly detection is a challenging problem that has been researched within a variety of application domains. In network intrusion detection, anomaly based techniques are particularly attractive because of their ability to identify previously unknown attacks without the need to be programmed with the specific signatures of every possible attack. There is a significant body of work in anomaly based intrusion detection applying statistical analysis, data-mining, and machine learning disciplines. However despite more than two decades of active research, there is a striking lack of anomaly based systems in commercial use today. Many of the currently proposed anomaly based systems do not adequately address a series of challenges making them unsuitable for operational deployment. In existing approaches, every step of the anomaly detection process requires expert manual intervention. This dependence makes developing practical systems extremely challenging. In this thesis, we integrate the strengths of machine learning and quality-of-service mitigation techniques for network anomaly detection, and build an operationally practical framework for anomaly- based network intrusion detection. We propose methods for self-adaptive, self-tuning, self-optimizing, and automatically responsive network anomaly detection. In specific, we propose and develop methods for adaptive input normalization adjusting scaling parameters online based on evolving values in observed traffic patterns, adaptive algorithms for flow-based network anomaly detection that respond to feedback to account for concept drift, and evolving methods for aggregated alert correlation that consolidate individual alarms into network events. We propose and design a model for dictating optimal performance in an anomaly detection system and reinforcement learning algorithms for automated tuning and optimization and a confidence forwarding model to support automated response. Furthermore, we develop a fair bandwidth sharing and delay differentiation mechanism for scalable automated response that insulates network resources from malicious traffic while minimizing collateral damage. We develop a prototype network anomaly detection system that integrates the proposed and developed techniques. We evaluate developed approaches using the 1999 Knowledge Discovery and Data-mining Cup and MAWI Lab datasets, but also we create a new dataset based on a combination of live network traces and controlled simulated data injects. Results demonstrate the effectiveness and capability of automated means.

Automated network anomaly detection with learning, control and mitigation

Research on Network Security Filtering Model and Key Algorithms Based on Network Abnormal Traffic Analysis

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

Anomaly detection system for network transport with machine learning approach

Network Anomaly Detection and Localization

Anomaly detection through statistics-based machine learning for computer networks

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

: Towards Fine-Grained Unknown Class Detection Against the Open-Set Attack Spectrum with Variable Legitimate Traffic

Interactive Learning for Network Anomaly Monitoring and Detection with Human Guidance in the Loop

Recent Advances in Machine Learning-based Anomaly Detection for Industrial Control Networks

A Human-in-the-Loop Anomaly Detection Architecture for Big Traffic Data of Cellular Network

Develop End-to-End Anomaly Detection System

A data-driven approach for intrusion and anomaly detection using automated machine learning for the Internet of Things

Reinforcement Learning Meets Network Intrusion Detection: A Transferable and Adaptable Framework for Anomaly Behavior Identification

Behavior Pattern Mining from Traffic and Its Application to Network Anomaly Detection

An overview of anomaly detection techniques: Existing solutions and latest technological trends

Performance Analysis of Anomaly-Based Network Intrusion Detection Using Feature Selection and Machine Learning Techniques

Network Anomaly Detection Using Federated Learning

Anomaly-based network intrusion detection: Techniques, systems and challenges

MSCA: an Unsupervised Anomaly Detection System for Network Security in Backbone Network.

Research on Anomaly Network Detection Based on Self-Attention Mechanism