Abnormal Network Traffic Detection Using Support Vector Data Description

摘要

Outlier detection also popularly known as anomaly detection is the process of recognizing whether the given data is normal or abnormal. Some of the applications of this outlier detection are: network intrusion detection, fraud detection, database cleaning, etc.; In most situations, there is scarcity of abnormal data where as plenty of normal data is available. This is the biggest challenge of novelty detection. The characteristics of abnormal or outlier data are often unknown beforehand. Density estimation methods can be used for novelty detection tasks. These methods work only when the assumed data distribution is same as the underlying data distribution which may not be known in advance. C-SVDD and v-SVDD are used for novelty detection tasks in our experiments. Experiments are performed on a toy data set of bivariate and overlapping classes and real-time multivariate data. Different kernels are also used for experimental studies. All experiments shows that RBF (Gaussian) kernel gives better performance than the other types of kernels. Experimental results on both artificial and real-world data are reported to illustrate the promising performance of outlier data detection.