Skip to main content
SpringerLink
Log in

Robust Variational Autoencoders and Normalizing Flows for Unsupervised Network Anomaly Detection

  • Conference paper
  • First Online:
Advanced Information Networking and Applications (AINA 2022)

Part of the book series: Lecture Notes in Networks and Systems ((LNNS,volume 450))

Abstract

In recent years, the integration of connected devices in smart homes has significantly increased, thanks to the advent of the Internet of things (IoT). However, these IoT devices introduce new security challenges, since any anomalous behavior has a serious impact on the whole network. Network anomaly detection has always been of considerable interest for every actor in the network landscape. In this paper, we propose GRAnD, an algorithm for unsupervised anomaly detection. Based on Variational Autoencorders and Normalizing Flows, GRAnD learns from network traffic metadata a normal profile representing the expected nominal behavior of the network. Then, this model is optimized to detect anomalies. Unlike existing anomaly detectors, our method is robust to the hyperparameter selection and outliers contaminating the training data. Extensive experiments and sensitivity analyses on public network traffic benchmark datasets demonstrate the effectiveness of our approach in network anomaly detection.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 219.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 279.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Malware and network attacks in 2019. https://www.helpnetsecurity.com/2019/12/13/network-attacks-2019/

  2. NFStream - a Network Data Analysis Framework. https://nfstream.org/

  3. Akrami, H., Joshi, A.A., Li, J., Aydore, S., Leahy, R.M.: Robust variational autoencoder. CoRR (2020)

    Google Scholar 

  4. An, J., Cho, S.: Variational autoencoder based anomaly detection using reconstruction probability (2015)

    Google Scholar 

  5. Balkema, A.A., De Haan, L.: Residual life time at great age. Ann. Probab. 2(5), 792–804 (1974)

    Google Scholar 

  6. Breunig, M., Kriegel, H., Ng, R., Sander, J.: LOF: identifying density-based local outliers (2000)

    Google Scholar 

  7. Chandola, V., Banerjee, A., Kumar, V.: Anomaly detection: a survey. ACM Comput. Surv. 41, 1–58 (2009)

    Article  Google Scholar 

  8. Desforges, M.J., Jacob, P.J., Cooper, J.E.: Applications of probability density estimation to the detection of abnormal conditions in engineering. Proc. Inst. Mech. Eng. 212(8), 687–703 (1998)

    Google Scholar 

  9. Fernandes, G., Rodrigues, J.J.P.C., Carvalho, L.F., Al-Muhtadi, J.F., Proença, M.L.: A comprehensive survey on network anomaly detection. Telecommun. Syst. 70(3), 447–489 (2019). https://doi.org/10.1007/s11235-018-0475-8

    Article  Google Scholar 

  10. Guerra-Manzanares, A., Medina-Galindo, J., Bahsi, H., Nõmm, S.: MedBIoT: generation of an IoT botnet dataset in a medium-sized IoT network. In: ICISSP, Valletta, Malta, pp. 207–218 (2020)

    Google Scholar 

  11. Kingma, D.P., Welling, M.: Auto-encoding variational bayes. CoRR (2014)

    Google Scholar 

  12. Kotani, G., Sekiya, Y.: Unsupervised scanning behavior detection based on distribution of network traffic features using robust autoencoders. In: (ICDMW), pp. 35–38 (2018)

    Google Scholar 

  13. Kriegel, H.P., Schubert, M., Zimek, A.: Angle-based outlier detection in high-dimensional data. In: ACM SIGKDD, KDD 2008, pp. 444–452 (2008)

    Google Scholar 

  14. Lai, C.H., Zou, D., Lerman, G.: Robust subspace recovery layer for unsupervised anomaly detection. In: ICLR (2020)

    Google Scholar 

  15. Lerman, G., Maunu, T.: An overview of robust subspace recovery (2018)

    Google Scholar 

  16. NSL-KDD: Canadian Institute for Cybersecurity | UNB

    Google Scholar 

  17. Rezende, D.J., Mohamed, S.: Variational inference with normalizing flows. In: ICML (2015)

    Google Scholar 

  18. Ringberg, H., Soule, A., Rexford, J., Diot, C.: Sensitivity of PCA for traffic anomaly detection. In: ACM SIGMETRICS, pp. 109–120 (2007)

    Google Scholar 

  19. Schölkopf, B., Williamson, R.C., Smola, A.J., Shawe-Taylor, J., Platt, J.C.: Support vector method for novelty detection. In: Solla, S., Leen, T., Müller, K. (eds.) Advances in Neural Information Processing Systems, vol. 12. MIT Press (1999). https://proceedings.neurips.cc/paper/1999/file/8725fb777f25776ffa9076e44fcfd776-Paper.pdf

  20. Siffer, A., Fouque, P.A., Termier, A., Largouet, C.: Anomaly detection in streams with extreme value theory. In: ACM SIGKDD, pp. 1067–1075 (2017)

    Google Scholar 

  21. Tax, D.M., Duin, R.P.: Support vector data description. Mach. Learn. 54, 45–66 (2004)

    Article  Google Scholar 

  22. Yang, X., Latecki, L.J., Pokrajac, D.: Outlier detection with globally optimal exemplar-based GMM. In: SDM, pp. 145–154 (2009)

    Google Scholar 

  23. Zhou, C., Paffenroth, R.C.: Anomaly detection with robust deep autoencoders. In: ACM SIGKDD - KDD 2017 (2017)

    Google Scholar 

  24. Zong, B., et al.: Deep autoencoding Gaussian mixture model for unsupervised anomaly detection. In: ICLR, p. 19 (2018)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Orange Labs, Meylan, France

    Naji Najari, Samuel Berlemont & Grégoire Lefebvre

  2. LIRIS UMR 5205 CNRS, Villeurbanne, France

    Naji Najari, Stefan Duffner & Christophe Garcia

  3. INSA Lyon, Villeurbanne, France

    Naji Najari, Stefan Duffner & Christophe Garcia

Authors
  1. Naji Najari
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Samuel Berlemont
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Grégoire Lefebvre
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Stefan Duffner
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Christophe Garcia
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Naji Najari .

Editor information

Editors and Affiliations

  1. Department of Information and Communication Engineering, Fukuoka Institute of Technology, Fukuoka, Japan

    Leonard Barolli

  2. University of Technology Sydney, Sydney, NSW, Australia

    Farookh Hussain

  3. Faculty of Bussiness Administration, Rissho University, Tokyo, Japan

    Tomoya Enokido

Rights and permissions

Reprints and permissions

Copyright information

© 2022 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Najari, N., Berlemont, S., Lefebvre, G., Duffner, S., Garcia, C. (2022). Robust Variational Autoencoders and Normalizing Flows for Unsupervised Network Anomaly Detection. In: Barolli, L., Hussain, F., Enokido, T. (eds) Advanced Information Networking and Applications. AINA 2022. Lecture Notes in Networks and Systems, vol 450. Springer, Cham. https://doi.org/10.1007/978-3-030-99587-4_24

Download citation

Publish with us

Policies and ethics

Search

Navigation