Unsupervised Contextual Anomalous Communication Detection Using VQ Tokenization with Flow Data
摘要
The widespread use of IoT devices has increased the importance of IoT security, and research on anomaly detection has attracted attention due to the properties of IoT devices, such as low resources. Flow data-based methods such as IPFIX, have attracted attention for the purpose of reducing analysis data from scalability perspective, but improving detection accuracy remains challenging. Recently, anomaly detection methods based on natural language processing (NLP) techniques have been proposed, and improved accuracy has been reported by considering the flow data context. In the application of NLP to flow data containing quantitative variables, it is necessary to construct a vocabulary by tokenization, which is different from the NLP. In this study, we propose a novel anomaly detection method combining a Vector Quantized Variational AutoEncoder (VQ-VAE) and a Transformer. This method improves the accuracy of anomaly detection by simultaneously learning the VQ-VAE and Transformer to achieve aggregated tokenization between flows with similar statistical and sequential characteristics. Experimental results on the ToN-IoT dataset showed that the proposed method achieves higher accuracy than methods in previous studies.