论文标题
在工业网络中对内容敏感异常检测的表示形式学习
Representation Learning for Content-Sensitive Anomaly Detection in Industrial Networks
论文作者
论文摘要
本文使用基于Convru的自动编码器，提出了一个框架，以不受监督和协议 - 不合Stic的方式学习原始网络流量的时空方面。学习的表示形式用于测量对随后的异常检测结果的影响，并将其与没有提取特征的应用进行比较。评估表明，当在压缩流量片段上应用网络入侵检测时，无法有效地增强异常检测。然而，受过训练的自动编码器成功地生成了网络流量的压缩表示（代码），该网络流量拥有空间和时间信息。基于模型剩余损失，自动编码器也能够单独检测异常。最后，研究了一种模型可解释性（LRP）的方法，以确定原始输入数据中的相关领域，该区域用于丰富通过异常检测方法生成的警报。
Using a convGRU-based autoencoder, this thesis proposes a framework to learn spatial-temporal aspects of raw network traffic in an unsupervised and protocol-agnostic manner. The learned representations are used to measure the effect on the results of a subsequent anomaly detection and are compared to the application without the extracted features. The evaluation showed, that the anomaly detection could not effectively be enhanced when applied on compressed traffic fragments for the context of network intrusion detection. Yet, the trained autoencoder successfully generates a compressed representation (code) of the network traffic, which hold spatial and temporal information. Based on the models residual loss, the autoencoder is also capable of detecting anomalies by itself. Lastly, an approach for a kind of model interpretability (LRP) was investigated in order to identify relevant areas within the raw input data, which is used to enrich alerts generated by an anomaly detection method.
