Abstract:Hybrid Anomaly Detection Model (HADM) is a platform that filters network traffic and identifies malicious activities on the network. The platform applies data mining techniques to tackle effectively the security issues in high load communication networks. The platform uses a combination of linear and learning algorithms combined with protocol analyzer. The linear algorithms filter and extract distinctive attributes and features of the cyber-attacks while the learning algorithms use these attributes and features to identify new types of cyber-attacks. The protocol analyzer in this platform classifies and filters vulnerable protocols to avoid unnecessary computation load. The use of linear algorithms in conjunction with learning algorithms and protocol analyzer allows the HADM to achieve improved efficiency in terms of accuracy and computation time to detect cyber-attacks over existing solutions. While authors' previous paper evaluated HADM efficiency (accuracy and computation time) against related studies, this paper, concentrates on HADM robustness and scalability. For this purpose, five datasets, including ISCX-2012, UNSW-NB15 Jan, UNSW-NB15 Feb, ISCX-2017, and MAWILab-2018, with various size and diverse attacks have been used. Different feature selection methods are applied to find the best features. The feature selection methods are selected based on the algorithms' computation time and detection rate. The best algorithms are then selected through a benchmark on applied datasets and based on the metrics such as cross-entropy loss, precision, recall, and computation time. The result of HADM platform shows robustness and scalability against datasets with different size and diverse attacks.

The Design And Implementation Of A Multidimensional And Hierarchical Web Anomaly Detection System

Anomaly Detection for Multivariate Time Series in IoT Using Discrete Wavelet Decomposition and Dual Graph Attention Networks

AnomalyDetect: An Online Distance-Based Anomaly Detection Algorithm

Multi-layer Anomaly Detection for Internet Traffic Based on Data Mining

Anomaly Detection Model Based on Hadoop Platform and Weka Interface

Interactive Context-Aware Anomaly Detection Guided by User Feedback

Fast Anomaly Identification Based on Multi-Aspect Data Streams for Intelligent Intrusion Detection Toward Secure Industry 4.0

A Lightweight Web Server Anomaly Detection Method Based on Transductive Scheme and Genetic Algorithms.

WebAD ^2 2 : A Cascading Model Based on Machine Learning for Web Attacks Detection.

Traffic Anomaly Detection in Backbone Networks Using Classification of Multidimensional Time Series of Entropy

A HMM-based Method for Anomaly Detection

Anomaly-Based Web Attack Detection: A Deep Learning Approach

WSAD: An Unsupervised Web Session Anomaly Detection Method

An Adaptive Anomaly Detection Based on Hierarchical Clustering

Practical Anomaly Detection over Multivariate Monitoring Metrics for Online Services

Multidimensional Clustering Based Anomaly Detection Research

Performance Evaluation of a Combined Anomaly Detection Platform

MSCA: an Unsupervised Anomaly Detection System for Network Security in Backbone Network.

A Framework for Adaptive Anomaly Detection Based on Support Vector Data Description

An Improved Payload-Based Anomaly Detector for Web Applications.

A Dynamic Anomaly Detection Model for Web User Behavior Based on HsMM