Comparing Autoencoder and Isolation Forest in Network Anomaly Detection
Timotej Smoleň, Lenka Benova · 2023
Anomaly detection is essential to spot cyber-attacks within networks. Unsupervised anomaly detection methods are becoming more popular due to difficult and expensive process of labeling network data as well as their superior ability to detect unknown attacks when compared with supervised or signature-based solutions. In this paper, we use an LSTM-based Autoencoder (RAE) anomaly detection model trained in a fully unsupervised environment, with optimizations for minimal memory usage. Secondly, we compare RAE with an Isolation Forest model by analysing their results. RAE attempts to capture the profile of the data by dimensionality reduction and the use of LSTM layers enables it to leverage the data from previous requests. Reconstruction error is calculated to decide about the abnormality. We train models on a dataset of requests towards a webserver in an unsupervised fashion. Before training, significant feature engineering is done to process multiple categorical attributes. The training process of RAE is optimized for minimum memory usage. We evaluated the results based on our analysis of the data as well as their statistical features. A manual analysis revealed differing focuses between numerical and categorical attributes. Isolation Forest disregards most categorical attributes and emphasizes numerical values. RAE on the other hand detects missing features more effectively but largely disregards numerical attributes. As such, RAE might have a higher probability of detecting a zero-day attack when compared to Isolation Forest.