Abstract:With the wide deployment of edge devices, a variety of emerging applications have been deployed at the edge of network. To guarantee the safe and efficient operations of the edge applications, especially the extensive web applications, it is important and challenging to detect packet payload anomalies, which can be expressed as a number of specific strings that may cause attacks. Although some approaches have achieved remarkable progress, they are with limited applications since these approaches are dependent on in-depth expert knowledge, e.g., signatures describing anomalies or communication protocol at the application level. Moreover, they might fail to detect the payload anomalies that may have long-term dependency relationships at the edge of network. To overcome these limitations and adaptively detect anomalies from packet payloads, we propose a deep learning based framework which does not rely on any in-depth expert knowledge and is capable of detecting anomalies that have long-term dependency relationships. The proposed framework consists of two parts. First, a novel block sequence construction method is proposed to obtain a valid expression of a payload. The block sequence could encapsulate both the high-dimension information and the underlying sequential information which facilitate the anomaly detection. Secondly, we design a detection model to learn two different dependency relationships within the block sequence, which is based on Long Short-Term Memory (LSTM), Convolutional Neural Networks (CNN) and Multi-head Self Attention Mechanism. Furthermore, we cast the anomaly detection as a classification problem and employ a classifier with attention mechanism to integrate information and detect anomalies. Extensive experimental results on three public datasets indicate that our model could achieve a higher detection rate, while keeping a lower false positive rate compared with two traditional machine learning methods and three state-of-the-art methods.

Word Embedding-based Context-sensitive Network Flow Payload Anomaly Detection

Packet Payload Based Anomalous Network Intrusion Detection

Deep anomaly detection in packet payload

Detecting Anomalies In Encrypted Traffic Via Deep Dictionary Learning

An Unsupervised Framework for Anomaly Detection in a Water Treatment System

Attention-based Encoder-Decoder Recurrent Neural Networks for HTTP Payload Anomaly Detection

A traffic anomaly detection approach based on unsupervised learning for industrial cyber-physical system

Detecting zero-day attacks using context-aware anomaly detection at the application-layer

FlowGANAnomaly: Flow-Based Anomaly Network Intrusion Detection with Adversarial Learning

Application-Layer Anomaly Detection Leveraging Time-Series Physical Semantics in CAN-FD Vehicle Networks

A Biological Immunity-Based Neuro Prototype for Few-Shot Anomaly Detection with Character Embedding

A CVAE-Based Anomaly Detection Algorithm for Cyber Physical Attacks for Water Distribution Systems

A novel anomaly detection method for multimodal WSN data flow via a dynamic graph neural network

A Novel Self-Supervised Learning-Based Anomalous Node Detection Method Based on an Autoencoder for Wireless Sensor Networks

ADSAD: An unsupervised attention-based discrete sequence anomaly detection framework for network security analysis

Generic and Sensitive Anomaly Detection of Network Covert Timing Channels

Self-Attention Memory-Augmented Wavelet-CNN for Anomaly Detection

Weighted-Neighborhood-Information-Network-Enabled Anomaly Detection Method for Electronic Sensors and Sensor Networks

End-To-End Anomaly Detection for Identifying Malicious Cyber Behavior through NLP-Based Log Embeddings

Packet2Vec: Utilizing Word2Vec for Feature Extraction in Packet Data