A Comparison of Unsupervised Anomaly Detection Methods on a Unified Host and Network Dataset
No ratings
Presented at NCS2019 2020 by
Systems administrators need to efficiently detect and respond to cybersecurity breaches to protect their network. By effectively detecting anomalous activity in NetFlow data, systems administrators can limit the amount of packet capture they analyze so they can evaluate and respond to threats quicker. Unsupervised machine learning methods are an effective way to do so, as they can detect previously unseen types of malicious activity and do not require labeled datasets. In this paper, we compare unsupervised anomaly detection methods to detect potentially malicious connections. We evaluate an Autoencoder, Isolation Forest, Elliptic Envelope, Local Outlier Factor, and One Class Support Vector Machine. We show that all five methods effectively separate the data into connections with different network activity, but Isolation Forest, the Autoencoder, and Elliptic Envelope detect anomalies the best. Our findings are useful for reducing the amount of packet capture systems administrators need to evaluate to respond to threats.