Machine Learning-Based Network Anomaly Detection: Design, Implementation, and Evaluation

<b>Background:</b> In the last decade, numerous methods have been proposed to define and detect outliers, particularly in complex environments like networks, where anomalies significantly deviate from normal patterns. Although defining a clear standard is challenging, anomaly detection s...

Full description

Saved in:
Bibliographic Details
Main Authors: Pilar Schummer, Alberto del Rio, Javier Serrano, David Jimenez, Guillermo Sánchez, Álvaro Llorente
Format: Article
Language:English
Published: MDPI AG 2024-12-01
Series:AI
Subjects:
Online Access:https://www.mdpi.com/2673-2688/5/4/143
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:<b>Background:</b> In the last decade, numerous methods have been proposed to define and detect outliers, particularly in complex environments like networks, where anomalies significantly deviate from normal patterns. Although defining a clear standard is challenging, anomaly detection systems have become essential for network administrators to efficiently identify and resolve irregularities. <b>Methods:</b> This study develops and evaluates a machine learning-based system for network anomaly detection, focusing on point anomalies within network traffic. It employs both unsupervised and supervised learning techniques, including change point detection, clustering, and classification models, to identify anomalies. SHAP values are utilized to enhance model interpretability. <b>Results:</b> Unsupervised models effectively captured temporal patterns, while supervised models, particularly Random Forest (94.3%), demonstrated high accuracy in classifying anomalies, closely approximating the actual anomaly rate. <b>Conclusions:</b> Experimental results indicate that the system can accurately predict network anomalies in advance. Congestion and packet loss were identified as key factors in anomaly detection. This study demonstrates the potential for real-world deployment of the anomaly detection system to validate its scalability.
ISSN:2673-2688