{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/network-traffic-anomaly-detection-using","title":"Network Traffic Anomaly Detection Using Recurrent Neural Networks","arxiv_id":"1803.10769","date":"2018-03-28","proceeding":null,"authors":["Benjamin J. Radford","Leonardo M. Apolonio","Antonio J. Trias","Jim A. Simpson"],"abstract":"We show that a recurrent neural network is able to learn a model to represent\nsequences of communications between computers on a network and can be used to\nidentify outlier network traffic. Defending computer networks is a challenging\nproblem and is typically addressed by manually identifying known malicious\nactor behavior and then specifying rules to recognize such behavior in network\ncommunications. However, these rule-based approaches often generalize poorly\nand identify only those patterns that are already known to researchers. An\nalternative approach that does not rely on known malicious behavior patterns\ncan potentially also detect previously unseen patterns. We tokenize and\ncompress netflow into sequences of \"words\" that form \"sentences\" representative\nof a conversation between computers. These sentences are then used to generate\na model that learns the semantic and syntactic grammar of the newly generated\nlanguage. We use Long-Short-Term Memory (LSTM) cell Recurrent Neural Networks\n(RNN) to capture the complex relationships and nuances of this language. The\nlanguage model is then used predict the communications between two IPs and the\nprediction error is used as a measurement of how typical or atyptical the\nobserved communication are. By learning a model that is specific to each\nnetwork, yet generalized to typical computer-to-computer traffic within and\noutside the network, a language model is able to identify sequences of network\nactivity that are outliers with respect to the model. We demonstrate positive\nunsupervised attack identification performance (AUC 0.84) on the ISCX IDS\ndataset which contains seven days of network activity with normal traffic and\nfour distinct attack patterns.","url_abs":"http://arxiv.org/abs/1803.10769v1","url_pdf":"http://arxiv.org/pdf/1803.10769v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"network-traffic-anomaly-detection-using","repo_url":"https://github.com/alinazhiltsova/Replication_arxiv_1803_10769","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":null},{"paper_slug":"network-traffic-anomaly-detection-using","repo_url":"https://github.com/benradford/replication_arxiv_1803_10769","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null}],"tasks":[{"task_slug":"anomaly-detection","task_name":"Anomaly Detection"},{"task_slug":"language-modeling","task_name":"Language Modeling"},{"task_slug":"language-modelling","task_name":"Language Modelling"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}