Hybrid Machine Learning Traffic Flows Analysis for Network Attacks Detection

This research focuses on network behavior analysis and provides a comprehensive flow-based anomaly detection proposal, which is based on combined machine learning and entropy-based anomaly detection techniques. The entropy-based analysis can capture the behavior of the biggest contributors, and of a large number of minor appearances in the feature distribution, thus it is applied for the needs of easier detection of rare traffic patterns. Then, the range of the machine learning algorithms can be applied in order to process the detected unusual traffic. The approach relies on the understanding of legitimate traffic behavior characteristics, which is further used to efficiently detect anomalous traffic patterns and deviations that cause performance issues or indicate a breach. This way, it is possible to provide near real-time alerting and visibility of potential network security threats. This approach allows the detection of unknown threats, zero-day attacks, and suspicious behavior while providing performance optimization possibilities.