Data-Driven Network Analysis for Anomaly Traffic Detection.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Traffic Analysis

Background:

• Classical cybersecurity systems struggle with zero-day attacks.
• Existing machine learning datasets lack realistic traffic diversity and attack scenarios.
• Effective anomaly detection requires comprehensive and realistic network data.

Purpose of the Study:

• To develop a realistic network dataset with diverse attack and background traffic.
• To evaluate machine learning algorithms for anomaly detection using the created dataset.
• To assess the performance of a CNN-Pseudo-AE model against classical supervised methods.

Main Methods:

• Creation of a novel, realistic network dataset incorporating various attack types and background traffic (HTTPs, streaming, SMTP).
• Implementation and comparison of unsupervised machine learning algorithms, specifically a Convolutional Neural Network (CNN) combined with a Pseudo Auto-Encoder (AE).
• Evaluation of detection performance against classical supervised machine learning algorithms for anomaly traffic, with a focus on Distributed Denial of Service (DDoS) attacks.

Main Results:

• The developed dataset provides a realistic environment for training and testing anomaly detection systems.
• The CNN-Pseudo-AE unsupervised model demonstrated detection performance comparable to traditional supervised learning algorithms.
• The findings highlight the potential of the CNN-Pseudo-AE architecture for practical cybersecurity applications.

Conclusions:

• The created realistic network dataset addresses limitations of existing resources.
• The CNN-Pseudo-AE model offers a viable unsupervised approach for detecting sophisticated network anomalies.
• This research contributes a promising tool for enhancing cybersecurity defenses against advanced threats.