LADS: A Live Anomaly Detection System based on Machine Learning Methods

Gustavo Gonzalez-Granadillo, Rodrigo Diaz, Ibéria Medeiros, Susana Gonzalez-Zarzosa, Dawid Machnicki

2019

Abstract

Network anomaly detection using NetFlow has been widely studied during the last decade. NetFlow provides the ability to collect network traffic attributes (e.g., IP source, IP destination, source port, destination port, protocol) and allows the use of association rule mining to extract the flows that have caused a malicious event. Despite of all the developments in network anomaly detection, the most popular procedure to detect non-conformity patterns in network traffic is still manual inspection during the period under analysis (e.g., visual analysis of plots, identification of variations in the number of bytes, packets, flows). This paper presents a Live Anomaly Detection System (LADS) based on One class Support Vector Machine (One-class SVM) to detect traffic anomalies. Experiments have been conducted using a valid data-set containing over 1.4 million packets (captured using NetFlow v5 and v9) that build models with one and several features in order to identify the approach that most accurately detects traffic anomalies in our system. A multi-featured approach that restricts the analysis to one IP address and extends it in terms of samples (valid and invalid ones) is considered as a promising approach in terms of accuracy of the detected malicious instances.

Paper Citation

in Harvard Style

Gonzalez-Granadillo G., Diaz R., Medeiros I., Gonzalez-Zarzosa S. and Machnicki D. (2019). LADS: A Live Anomaly Detection System based on Machine Learning Methods.In Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT, ISBN 978-989-758-378-0, pages 464-469. DOI: 10.5220/0007948904640469

in Bibtex Style

@conference{secrypt19,
author={Gustavo Gonzalez-Granadillo and Rodrigo Diaz and Ibéria Medeiros and Susana Gonzalez-Zarzosa and Dawid Machnicki},
title={LADS: A Live Anomaly Detection System based on Machine Learning Methods},
booktitle={Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT,},
year={2019},
pages={464-469},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0007948904640469},
isbn={978-989-758-378-0},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT,
TI - LADS: A Live Anomaly Detection System based on Machine Learning Methods
SN - 978-989-758-378-0
AU - Gonzalez-Granadillo G.
AU - Diaz R.
AU - Medeiros I.
AU - Gonzalez-Zarzosa S.
AU - Machnicki D.
PY - 2019
SP - 464
EP - 469
DO - 10.5220/0007948904640469