Learning Neural Representations for Network Anomaly Detection.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Traditional network anomaly detection methods struggle with high-dimensional, sparse data and limited anomaly examples.
• Challenges include difficulties in training, model selection, and hyperparameter tuning for anomaly detection algorithms.

Purpose of the Study:

• To propose novel latent representation models for improving network anomaly detection.
• To address the limitations of existing methods in handling complex network data characteristics.

Main Methods:

• Introduced new regularizers to classical autoencoder (AE) and variational AE (VAE) models.
• Forced normal data into a tight, origin-centered area in the bottleneck activation space.
• Utilized the bottleneck feature space as a new data representation for anomaly detection.

Main Results:

• Trained AEs push normal data points toward the origin, while anomalies are mapped far from this region.
• Proposed models demonstrated efficient and consistent performance on high-dimensional, sparse network datasets.
• Achieved robust results even with limited training data and minimized the impact of model selection.

Conclusions:

• The developed latent representation models significantly improve network anomaly detection capabilities.
• These models offer a robust solution for handling challenging network data, enhancing classifier performance.
• The approach demonstrates resilience to hyperparameter variations, simplifying model deployment.