A model for network traffic anomaly detection

Abstract

Network traffic anomaly detection can find unusual events cause by hacker activity. Most research in this area focus on supervised and unsupervised model. In this work, we proposed a semi-supervised model based on combination of Mahalanobis distance and principal component analysis for network traffic anomaly detection. We also experiment clustering technique with suitable features to remove noise in training data along with some enhanced detection technique. With the approach of combining anomaly detection and signature-based detection system, we believe the quality of normal dataset will greatly improve.