论文标题
通过拓扑流量分析无监督的异常交通检测
Unsupervised Abnormal Traffic Detection through Topological Flow Analysis
论文作者
论文摘要
网络威胁是我们现代技术世界中的永久关注点。近年来，采用了复杂的交通分析技术和异常检测（AD）算法，以面对越来越多的颠覆性对抗性攻击。一种恶意入侵，定义为旨在非法利用私人资源的侵入性行动，通过异常的数据流量和/或异常连接模式表现出来。尽管文献中目前提供了大量的统计或基于签名的检测器，但恶意流的拓扑连接组件的利用较少。此外，现有的统计入侵检测器中很大一部分基于监督学习，这取决于标记的数据。通过将网络流动为一对节点之间的加权定向相互作用，在本文中，我们提出了一种简单的方法，该方法促进了无监督的异常检测算法中连接图特征的使用。我们在实际网络流量数据集上测试我们的方法，并观察到标准AD的几个改进。
Cyberthreats are a permanent concern in our modern technological world. In the recent years, sophisticated traffic analysis techniques and anomaly detection (AD) algorithms have been employed to face the more and more subversive adversarial attacks. A malicious intrusion, defined as an invasive action intending to illegally exploit private resources, manifests through unusual data traffic and/or abnormal connectivity pattern. Despite the plethora of statistical or signature-based detectors currently provided in the literature, the topological connectivity component of a malicious flow is less exploited. Furthermore, a great proportion of the existing statistical intrusion detectors are based on supervised learning, that relies on labeled data. By viewing network flows as weighted directed interactions between a pair of nodes, in this paper we present a simple method that facilitate the use of connectivity graph features in unsupervised anomaly detection algorithms. We test our methodology on real network traffic datasets and observe several improvements over standard AD.
