Abstract:The proliferation of internet-connected devices and the complexity of modern network environments have led to the collection of massive and high-dimensional datasets, resulting in substantial information redundancy and sample imbalance issues. These challenges not only hinder the computational efficiency and generalizability of anomaly detection systems but also compromise their ability to detect rare attack types, posing significant security threats. To address these pressing issues, we propose a novel causal genetic network-based anomaly detection method, the CNSGA, which integrates causal inference and the nondominated sorting genetic algorithm-III (NSGA-III). The CNSGA leverages causal reasoning to exclude irrelevant information, focusing solely on the features that are causally related to the outcome labels. Simultaneously, NSGA-III iteratively eliminates redundant information and prioritizes minority samples, thereby enhancing detection performance. To quantitatively assess the improvements achieved, we introduce two indices: a detection balance index and an optimal feature subset index. These indices, along with the causal effect weights, serve as fitness metrics for iterative optimization. The optimized individuals are then selected for subsequent population generation on the basis of nondominated reference point ordering. The experimental results obtained with four real-world network attack datasets demonstrate that the CNSGA significantly outperforms existing methods in terms of overall precision, the imbalance index, and the optimal feature subset index, with maximum increases exceeding 10%, 0.5, and 50%, respectively. Notably, for the CICDDoS2019 dataset, the CNSGA requires only 16-dimensional features to effectively detect more than 70% of all sample types, including 6 more network attack sample types than the other methods detect. The significance and impact of this work encompass the ability to eliminate redundant information, increase detection rates, balance attack detection systems, and ensure stability and generalizability. The proposed CNSGA framework represents a significant step forward in developing efficient and accurate anomaly detection systems capable of defending against a wide range of cyber threats in complex network environments.

Ranking Causal Anomalies Via Temporal and Dynamical Analysis on Vanishing Correlations.

A Causal Approach to Detecting Multivariate Time-series Anomalies and Root Causes

Root-cause analysis for time-series anomalies via spatiotemporal causal graphical modeling.

RCAnalyzer: Visual Analytics of Rare Categories in Dynamic Networks

Detecting and Ranking Causal Anomalies in End-to-End Complex System

Inet: Visual Analysis of Irregular Transition in Multivariate Dynamic Networks

Causality-Based Multivariate Time Series Anomaly Detection

Spatio-Temporal Correlation Analysis of Online Monitoring Data for Anomaly Detection and Location in Distribution Networks

Low-Rank Characteristic and Temporal Correlation Analytics for Incipient Industrial Fault Detection with Missing Data

Data-Driven Root-Cause Analysis For Distributed System Anomalies

Subtle Anomaly Detection in Dynamic Networks Using Graph Spectra

Network traffic anomaly detection based on catastrophe theory

Root-cause analysis for time-series anomalies via spatiotemporal graphical modeling in distributed complex systems

An Anomaly Detection Framework for Time-Evolving Attributed Networks

Scalable Temporal Anomaly Causality Discovery in Large Systems: Achieving Computational Efficiency with Binary Anomaly Flag Data

Causal Genetic Network Anomaly Detection Method for Imbalanced Data and Information Redundancy

Community detection and anomaly prediction in dynamic networks

A Dynamic Network Anomaly Detection Method Based On Trend Analysis

Detecting Distributed Network Traffic Anomaly with Network-Wide Correlation Analysis

Dynamic Circular Network-Based Federated Dual-View Learning for Multivariate Time Series Anomaly Detection

A Time Series Anomaly Detection Method Based on Series-Parallel Transformers with Spatial and Temporal Association Discrepancies