Anomaly Detection and Machine Learning Methods for Network Intrusion Detection: an Industrially Focused Literature Review

摘要

This paper outlines a literature review undertaken towards the goal of creating an industrial viable (real world) anomaly detection/machine learning based network intrusion detection system. We develop a taxonomy of available methods, and outline the pros and cons of each. This review leads to several important conclusions: (1) There are a large number of algorithms in the literature with significant level of overlap; (2) given the state of the literature today, it is not possible to objectively select the best algorithm; (3) there is a lack of research on the feature selection process needed for machine learning approaches; and (4) the low base-rate of attacks on computer networks compared with benign traffic means that effective detection systems will consist of many detection algorithms working simultaneously.