Unsupervised Network Anomaly Detection with Autoencoders and Traffic Images

TL;DR

This paper introduces an unsupervised anomaly detection method for network traffic using image-based representations and autoencoders, enabling quick and efficient identification of security issues in heterogeneous, high-volume network environments.

Contribution

It proposes a novel image-based traffic representation combined with an unsupervised autoencoder approach for real-time anomaly detection in network data.

Findings

Effective detection of network anomalies using the proposed method

Compact 1-second traffic summaries highlight anomalies clearly

Open-source code and dataset available for reproducibility

Abstract

Due to the recent increase in the number of connected devices, the need to promptly detect security issues is emerging. Moreover, the high number of communication flows creates the necessity of processing huge amounts of data. Furthermore, the connected devices are heterogeneous in nature, having different computational capacities. For this reason, in this work we propose an image-based representation of network traffic which allows to realize a compact summary of the current network conditions with 1-second time windows. The proposed representation highlights the presence of anomalies thus reducing the need for complex processing architectures. Finally, we present an unsupervised learning approach which effectively detects the presence of anomalies. The code and the dataset are available at https://github.com/michaelneri/image-based-network-traffic-anomaly-detection.