A Robust and Effective Anomaly Detection Model for Identifying Unknown Network Traffic

Background: Network security is getting more serious and has attracted much attention in recent years. Anomaly detection is an important technology to identify bad network flows and protect the network, which has been a hot topic in the network security field. However, in an anomaly detection system, the unknown network flows are always identified as some known flows in the existing solutions, which results in poorer identification performance. Objective: Aiming at detecting unknown flows and improving the detection performance, based on the KDD’99 dataset from a simulated real network environment, we analyzed the dataset and the main factors which affect the accuracy, and proposed a more robust and effective anomaly detection model (READM) to improve the accuracy of the detection. Methods: Based on unknown flows determination, the extra unknown type class is trained by neural network and identified by deep inspection method. Then, the identification result for unknown class will be updated to the detection system. Finally, the newly proposed robust and effective anomaly detection model (READM) is constructed and validated. Results: Through experiments comparison and analysis, the results indicate that READM achieves higher detection accuracy and less prediction time, which proves more efficient and shows better performance. Conclusion: Our study found that the existence of unknown flows always results in error detection and becomes the main factor influencing the detection performance. So, we propose a robust and effective anomaly detection model based on the construction and training of the extra unknown traffic class. Through the comparison of three experiments with different ways of thinking, it is proved that READM improves detection accuracy and reduces prediction time. Besides, after comparing with other solutions, it also shows better performance and has great application value in this field.