A model for network traffic anomaly detection
Nguyen Ha Duong, Hoang Dang Hai · 2016 18th International Conference on Advanced Communication Technology (ICACT) · 2016
Network traffic anomaly detection can find unusual events cause by hacker activity. Most research in this area focus on supervised and unsupervised model. In this work, we proposed a semi-supervised model based on combination of Mahalanobis distance and principal component analysis for network traffic anomaly detection. We also experiment clustering technique with suitable features to remove noise in training data along with some enhanced detection technique. With the approach of combining anomaly detection and misuse detection system, we believe the quality of normal dataset will greatly improve.