There has been much research on Supervised Machine Learning for network intrusion detection. With Supervised Learning, the ground truth (in the form of labels for each sample) is known. In Unsupervised approaches, the labels are not known, so training involves finding similarities and differences to the extent that the samples can be clustered (or grouped). Clustering algorithms provide statistical techniques to accomplish classification of data into distinctive clusters. There are several methods of clustering. This research demonstrates and compares the algorithms of Kmeans, Kmeans++, DBSCAN, Latent-Class Gaussian Mixture, and Learning Automata Clustering (LAC). We show that LAC, a Reinforcement Learning algorithm, provides the highest accuracy (99.65%) for classifying the benign and malicious data samples. These results are promising for future research in Reinforcement Learning methods for network anomaly traffic detection.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Detection of Network Anomalies Using Unsupervised and Reinforcement Learning Models

  • Willie L. Waters,
  • Mohamed Chouikha,
  • Annamalai Annamalai

摘要

There has been much research on Supervised Machine Learning for network intrusion detection. With Supervised Learning, the ground truth (in the form of labels for each sample) is known. In Unsupervised approaches, the labels are not known, so training involves finding similarities and differences to the extent that the samples can be clustered (or grouped). Clustering algorithms provide statistical techniques to accomplish classification of data into distinctive clusters. There are several methods of clustering. This research demonstrates and compares the algorithms of Kmeans, Kmeans++, DBSCAN, Latent-Class Gaussian Mixture, and Learning Automata Clustering (LAC). We show that LAC, a Reinforcement Learning algorithm, provides the highest accuracy (99.65%) for classifying the benign and malicious data samples. These results are promising for future research in Reinforcement Learning methods for network anomaly traffic detection.