Detecting anomalies in network traffic using machine learning techniques

Abstract

The problem of anomaly detection in network traffic using machine learning and neural network methods is considered. Logistic regression, support vector method, random forest, gradient boosting, fully connected neural network and recurrent LSTM neural network were used as classification models for anomaly detection. A grid search for optimal parameters on cross-validation of these models was carried out. The architectures of the fully connected and recurrent LSTM neural network were developed. One-Class SVM, isolation Forest, Local Outlier Factor, Elliptic Envelope methods of oneclass classification were also applied. The application of ensembles of classifiers for detection of anomalous traffic, in particular, built using the stacking procedure, is considered. The efficiency of all algorithms is analysed.