PaperlayerView exact revision on arXiv

Source-linked AI summary

Network Traffic Anomaly Detection Using Recurrent Neural Networks

Benjamin J. Radford, Leonardo M. Apolonio, Antonio J. Trias, Jim A. Simpson

arXiv:1803.10769v1cs.CYcs.HCcs.LG

TL;DR

Known-attack signatures may not suffice for network defense, motivating anomaly detection from learned traffic patterns. The paper models per-IP-pair flow sequences with LSTM RNNs and reports unsupervised detection of malicious traffic, including with non-pristine training data.

  • Problem

    Signature-based intrusion detection that matches known attacks and vectors is described as no longer sufficient for network defense.

    Source: §I · p. 1

  • Method

    The approach tokenizes flows into ordered per-IP-pair sequences and trains an LSTM RNN to predict the next token in a sequence.

    Source: §III · p. 3, §IV · p. 3

  • Results

    The models detect malicious-use traffic without labeled training data, including when training data are not pristine; proto-byte sequences outperform service-port sequences in all tested scenarios.

    Source: §I · p. 1, §V · p. 4

  • Takeaways & Limitations

    The authors conclude that network behaviors can be learned from traffic metadata for anomaly detection purposes.

    Source: §VI · p. 6

    Positive overall performance does not guarantee field efficacy, since high false-positive rates can make result inspection impractical.

    Source: §V · p. 6

Abstract

from arXiv · show

We show that a recurrent neural network is able to learn a model to represent sequences of communications between computers on a network and can be used to identify outlier network traffic. Defending computer networks is a challenging problem and is typically addressed by manually identifying known malicious actor behavior and then specifying rules to recognize such behavior in network communications. However, these rule-based approaches often generalize poorly and identify only those patterns that are already known to researchers. An alternative approach that does not rely on known malicious behavior patterns can potentially also detect previously unseen patterns. We tokenize and compress netflow into sequences of "words" that form "sentences" representative of a conversation between computers. These sentences are then used to generate a model that learns the semantic and syntactic grammar of the newly generated language. We use Long-Short-Term Memory (LSTM) cell Recurrent Neural Networks (RNN) to capture the complex relationships and nuances of this language. The language model is then used predict the communications between two IPs and the prediction error is used as a measurement of how typical or atyptical the observed communication are. By learning a model that is specific to each network, yet generalized to typical computer-to-computer traffic within and outside the network, a language model is able to identify sequences of network activity that are outliers with respect to the model. We demonstrate positive unsupervised attack identification performance (AUC 0.84) on the ISCX IDS dataset which contains seven days of network activity with normal traffic and four distinct attack patterns.

I. INTRODUCTION

The paper frames network defense as a challenge for signature-based IDS, which may miss activity beyond known attacks. It proposes modeling network traffic sequences with LSTM RNNs to detect malicious activity without labeled training data, including when training data contain attacks.

  • Signature-based IDS approaches that match known attacks and vectors are described as no longer sufficient for network defense.The paper frames anomaly detection as evaluating future network activity against a learned model.Source: §I · p. 1
  • LSTM RNNs learn ordered sequences of network traffic and evaluate their ability to detect malicious activity on that network.Source: §I · p. 1
  • The models can detect malicious-use traffic without labeled training data or visibility into machine internals, including when training data are not pristine.The authors argue this matters where guaranteed clean training data are costly and rarely available.Source: §I · p. 1

II. BACKGROUND

The background motivates the work through cybersecurity and natural language processing, noting parallels between network logs and language modeling.

  • The paper situates its motivation at the intersection of cybersecurity and natural language processing.Source: §II · p. 1
  • Cybersecurity research increasingly uses machine learning and statistical models for tasks previously handled with signature matching.Source: §II · p. 1
  • The authors identify similarities between network logs, or netflow, and the challenges of modeling natural languages.Source: §II · p. 1

A. Cybersecurity

This background narrows the paper’s focus to network monitoring and describes flow logs as a practical data source. It contrasts signature and rule-based monitoring with machine-learning approaches.

A. Cybersecurity

  • The paper focuses specifically on anomalous network traffic monitoring, among the broader range of cybersecurity problems.Source: A. Cybersecurity · p. 2
  • Flow records can include communication timing and duration, IP addresses, bytes and packets, ports, and protocols, but an IP may not map consistently to one device.Source: A. Cybersecurity · p. 2
  • Network traffic logs can be collected passively and are relatively small compared with host logs or full packet captures.These properties make them a popular choice for organizational cybersecurity monitoring.Source: A. Cybersecurity · p. 2
  • Existing monitoring uses known-bad IP lists, traffic-volume limits, port and protocol checks, and customized SQL-like rules; machine learning offers an alternative to rules specified in advance.Source: A. Cybersecurity · p. 2
  • Prior machine-learning examples include user-in-the-loop web and firewall log analysis, process-based intrusion detection, and supervised network-traffic attack classification.The cited examples include LSTM RNNs for process intrusion detection and supervised network classification.Source: A. Cybersecurity · p. 2

B. Natural Language Processing

The paper draws on neural language modeling and treats network-flow sequences as language-like data whose underlying rules are obscured. It therefore motivates unsupervised language models for inferring network metadata patterns.

B. Natural Language Processing

  • Neural language models have been used to represent semantic and syntactic relationships, and LSTM RNNs have been applied to language modeling.The background also notes word2vec/doc2vec representations and LSTM-CNN models for language tasks.Source: B. Natural Language Processing · p. 2
  • Network communications form ordered sequences expected to follow service- and protocol-dependent rules, analogous to grammar.Source: B. Natural Language Processing · p. 2
  • Because the grammatical rules underlying network metadata are obscured from analysts, the authors present unsupervised language models as a natural way to infer its data-generating processes.Source: B. Natural Language Processing · p. 2

III. DATA

The study uses seven days of simulated ISCX IDS traffic to evaluate anomaly detection from flow metadata. Flows are organized into dyad sequences and dyad-hours, with attack labels reserved for validation.

III. DATA

  • The ISCX IDS dataset covers seven days of simulated traffic with infiltration, DoS, DDoS via IRC Botnet, and brute-force SSH attacks.The raw packet captures total roughly 90 GB.Source: §III · p. 2
  • The analysis uses a pre-processed flow-style dataset, with 1.9 million deduplicated metadata records occupying 412 MB.The metadata originally contained just over 2 million flow records.Source: §III · pp. 2–3
  • Flows are ordered into undirected IP-pair (dyad) sequences, using either protocol and floor(log2(bytes)) tokens or heuristically selected service-port tokens.Ports above 10,000 are collapsed into one token; the dataset contains 168,218 dyad-hours.Source: §III · p. 3
  • Sequences use rolling windows within dyad-hours; a unit is labeled as an attack if any source flow is labeled attack, while labels are withheld from model training.Sequences are zero-padded and masked to avoid bias from padding.Source: §III · p. 3

IV. METHODOLOGY

The methodology trains LSTM sequence models under clean and attack-contaminated baselines, then scores dyad-hours by prediction loss. Additional tests omit DoS and DDoS attacks to examine their possible effects on detection.

IV. METHODOLOGY

  • Dyad-hours are treated as attacks when they contain at least one attack-labeled flow; the authors note few units would differ under a majority-label rule.Attack labels are used for validation, not model training.Source: §IV · p. 3
  • The model embeds tokens in 100 dimensions, then uses two stacked bidirectional LSTM layers, a dense layer, and a softmax output to predict the next token.Training uses ten-token windows to predict the eleventh token, with 20% dropout and zero-masking.Source: §IV · p. 3
  • Multiclass logarithmic loss measures prediction error, and the maximum flow loss within each IP-dyad hour becomes its outlier score.The authors report that maximum aggregation performed better on selected metrics than averaging.Source: §IV · p. 3
  • Clean-baseline training uses the attack-free first day and a half, whereas dirty-baseline training uses the full dataset, including attack traffic.The comparison addresses settings where a clean period for baseline estimation may be infeasible or impossible.Source: §IV · p. 3
  • NoDoS tests remove June 14 and 15 because attack categories are unavailable at the flow level; the authors cite possible overfitting and metric inflation from high-volume DoS/DDoS traffic.The tests omit both attack days from training and evaluation.Source: §IV · pp. 3–4

V. RESULTS

The models identify anomalous traffic in clean and dirty baseline scenarios, with protocol-byte sequences outperforming service-port sequences across tested scenarios. Dirty-baseline models outperform clean-baseline models, while field efficacy remains uncertain.

V. RESULTS

  • AUC is used because it is threshold-agnostic, as the study has no labeled data for threshold calibration and offers no unsupervised threshold-selection method.Without the baseline attack rate, the authors say they cannot estimate an appropriate threshold for hard-partitioning observations and calculating accuracy.Source: §V · p. 4
  • Protocol-byte sequence models outperform service-port sequence models in all tested scenarios.The reported comparison includes NoDoS models; Figures 2–4 show ROC plots for the dirty baseline, clean baseline, and NoDoS models.Source: §V · p. 4, Figure 2 · p. 5, Figure 3 · p. 5
  • Service-port models have relatively high AUC in the dirty baseline, but their performance drops in the clean-baseline and NoDoS models for unclear reasons.The AUC metric ranges from 0.5 for random chance to 1.0 for perfect classification.Source: §V · p. 4, Figure 2 · p. 5, Figure 3 · p. 5
  • Dirty-baseline models outperform clean-baseline models in all cases.The authors suspect the larger dirty-baseline training dataset may explain the difference, but identify this as a hypothesis for future testing.Source: §V · pp. 4, 6, Figure 2 · p. 5, Figure 3 · p. 5
  • The NoDoS proto-byte model performs substantively the same as the dirty-baseline proto-byte model for attack detection.The authors interpret this as reassurance that proto-byte sequences are robust to attack type or characteristic.Source: Figure 4 · p. 5, §V · p. 6
  • Positive overall performance does not guarantee field efficacy; high AUC can coexist with false-positive rates that make inspection impractical.The authors caution that false positives can make results tedious, time-consuming, or impossible to inspect.Source: §V · p. 6

VI. CONCLUSION

The conclusion presents LSTM RNNs as a way to learn network behavior from traffic metadata for anomaly detection, using an unsupervised approach based on readily available, relatively cheap metadata.

VI. CONCLUSION

  • LSTM RNNs can learn network behaviors from traffic metadata for anomaly detection.Source: §VI · p. 6
  • The authors characterize the approach as an unsupervised tool for network protection.Source: §VI · p. 6
  • The method requires collection and storage of only readily available, relatively cheap network metadata.Source: §VI · p. 6
Loading 1803.10769v1…