An Empirical Evaluation of Deep Learning for Network Anomaly Detection

IEEE Access

Hyunjoo Kim¹  Ritesh K. Malaiya¹  Sang C. Suh²  Jinoh Kim³  Donghwoon Kwon⁴  Ikkyun Kim⁴ 

[1] Computer Science Department, Texas A&x0026;Department of Math, CSCI, and Physics, Rockford University, Rockford, IL, USA;Information Security Research Division, ETRI, Daejeon, South Korea;M University-Commerce, Commerce, TX, USA;

关键词: Network anomaly detection;    traffic analysis;    deep learning;    neural networks;    sequence-to-sequence;    performance evaluation;   

DOI  :  10.1109/ACCESS.2019.2943249

来源: DOAJ

【 摘 要 】

Deep learning has been widely studied in many technical domains such as image analysis and speech recognition, with its benefits that effectively deal with complex and high-dimensional data. Our preliminary experiments show a high degree of non-linearity from the network connection data, which explains why it is hard to improve the performance of identifying network anomalies by using conventional learning methods (e.g., Adaboosting, SVM, and Random Forest). In this study, we design and examine deep learning models constructed based on Fully Connected Networks (FCNs), Variational AutoEncoder (VAE), and Sequence-to-Sequence (Seq2Seq) structures. For the extensive evaluation, we employ a broad range of the public datasets with unique characteristics. Our experimental results confirm the feasibility of deep learning-based network anomaly detection, with the improved performance compared to the conventional learning techniques. In particular, the detection model based on Seq2Seq with LSTM is highly promising, consistently yielding over 99% of accuracy to identify network anomalies from the entire datasets employed in the evaluation.

【 授权许可】

Unknown