Abstract:Anomaly detection in computer networks is a complex task that requires the distinction of normality and anomaly. Network attack detection in information systems is a constant challenge in computer security research, as information systems provide essential services for enterprises and individuals. The consequences of these attacks could be the access, disclosure, or modification of information, as well as denial of computer services and resources. Intrusion Detection Systems (IDS) are developed as solutions to detect anomalous behavior, such as denial of service, and backdoors. The proposed model was inspired by the behavior of dendritic cells and their interactions with the human immune system, known as Dendritic Cell Algorithm (DCA), and combines the use of Multiresolution Analysis (MRA) Maximal Overlap Discrete Wavelet Transform (MODWT), as well as the segmented deterministic DCA approach (S-dDCA). The proposed approach is a binary classifier that aims to analyze a time-frequency representation of time-series data obtained from high-level network features, in order to classify data as normal or anomalous. The MODWT was used to extract the approximations of two input signal categories at different levels of decomposition, and are used as processing elements for the multi resolution DCA. The model was evaluated using the NSL-KDD, UNSW-NB15, CIC-IDS2017 and CSE-CIC-IDS2018 datasets, containing contemporary network traffic and attacks. The proposed MRA S-dDCA model achieved an accuracy of 97.37%, 99.97%, 99.56%, and 99.75% for the tested datasets, respectively. Comparisons with the DCA and state-of-the-art approaches for network anomaly detection are presented. The proposed approach was able to surpass state-of-the-art approaches with UNSW-NB15 and CSECIC-IDS2018 datasets, whereas the results obtained with the NSL-KDD and CIC-IDS2017 datasets are competitive with machine learning approaches.

Network Anomaly Detection Based On Multi-Scale Dynamic Characteristics Of Traffic

Packet Payload Based Anomalous Network Intrusion Detection

Worm Intrusion Alarm Modeling Based on Network Traffic Character

Network Traffic Anomaly Detection Method Based on Multi scale Residual Feature

Survey of Research on Anomaly Detection of Wavelet Analysis Based on Network Traffic

Research on the detection of abnormal traffic for multi-channel network

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy.

MBST: Detecting Packet-Level Traffic Anomalies by Feature Stability

Traffic Flow Anomaly Detection Based on Wavelet Denoising and Support Vector Regression

High-speed anomaly traffic detection based on staged frequency domain features

Research on Network Traffic Anomaly Detection Algorithm

Web-Based Application for Traffic Anomaly Detection Algorithm

A multi-channel anomaly detection method with feature selection and multi-scale analysis

MSCA: an Unsupervised Anomaly Detection System for Network Security in Backbone Network.

Network traffic analysis over clustering-based collective anomaly detection

Anomaly Detection Based on Traffic Information Structure

Unsupervised Anomalous Traffic Detection Based on Cascading Representation and Multiple-Clustering

Internet Anomaly Detection Based on Complex Network Path

Multiresolution dendritic cell algorithm for network anomaly detection

Analysis of Network Security Data Using Wavelet Transforms

Network Abnormal Traffic Detection Framework Based on Deep Reinforcement Learning