Assessing the Impact of a Supervised Classification Filter on Flow-based Hybrid Network Anomaly Detection

Dominik Macko, Patrik Goldschmidt, Peter Pištek, Daniela Chudá
10/10/2023
cs.AIcs.CRcs.NI

No official code found. Best implementation: kinit-sk/hybrid-anomaly-detection (4 stars, GPL-3.0, last commit 2023-10-16).

Abstract

Constant evolution and the emergence of new cyberattacks require the development of advanced techniques for defense. This paper aims to measure the impact of a supervised filter (classifier) in network anomaly detection. We perform our experiments by employing a hybrid anomaly detection approach in network flow data. For this purpose, we extended a state-of-the-art autoencoder-based anomaly detection method by prepending a binary classifier acting as a prefilter for the anomaly detector. The method was evaluated on the publicly available real-world dataset UGR'16. Our empirical results indicate that the hybrid approach does offer a higher detection rate of known attacks than a standalone anomaly detector while still retaining the ability to detect zero-day attacks. Employing a supervised binary prefilter has increased the AUC metric by over 11%, detecting 30% more attacks while keeping the number of false positives approximately the same.

View on arXivView PDF

Code Implementations(1)

kinit-sk/hybrid-anomaly-detectionCommunity100%
GPL-3.0

Source-code for replication of experiments in the paper "Assessing the Impact of a Supervised Classification Filter for Flow-based Hybrid Network Anomaly Detection".

40Jupyter NotebookSep 13, 20233 years agoGPL-3.0

Similar Papers

Using Kernel SHAP XAI Method to optimize the Network Anomaly Detection Model

84% match2023

Host-Based Network Intrusion Detection via Feature Flattening and Two-stage Collaborative Classifier

83% match2023

Contrastive Self-Supervised Network Intrusion Detection using Augmented Negative Pairs

83% match1 repo52025

Anomaly detection in network flows using unsupervised online machine learning

83% match2025

Are Existing Out-Of-Distribution Techniques Suitable for Network Intrusion Detection?

83% match1 repo62023

Early-Stage Anomaly Detection: A Study of Model Performance on Complete vs. Partial Flows

82% match1 repo2024

Cite this paper

@article{macko2023assessing,
  title  = {Assessing the Impact of a Supervised Classification Filter on Flow-based Hybrid Network Anomaly Detection},
  author = {Dominik Macko and Patrik Goldschmidt and Peter Pištek and Daniela Chudá},
  year   = {2023},
  eprint = {2310.06656},
  archivePrefix = {arXiv},
  url    = {http://arxiv.org/abs/2310.06656v1}
}

Add a badge to your README

Shows whether official code is linked for this paper.

Code of Paper badge
[![Code of Paper](https://codeofpaper.com/badge/2310.06656.svg)](https://codeofpaper.com/paper/2310.06656)

Discussion