Unsupervised Anomaly Detection in Network Traffic by Means of Robust PCA

Abstract

This paper points out the need for unsupervised anomaly detection in the context of instrusion detection systems. Our work is based on an approach which employs principal component analysis (PCA) in order to detect anomalies in measurements of certain network traffic parameters. We discuss the problem of contaminated training data and propose to use PCA on the basis of robust estimators to overcome the necessity of a supervised preprocessing step.