MIMC: Anomaly Detection in Network Data via Multiple Instances of Micro-Cluster Detection
Rafael Copstein, Bradley Niblett, Andrew Johnston, Jeff Schwartzentruber, Malcolm Iain Heywood, Nur Zincir-Heywood · 2023
This paper proposes and explores new attribute correlations and combined effort of multiple instances of microcluster-based anomaly detection on port scans, distributed denial of service and botnet attacks. To this end, the proposed system for micro-clustering based anomaly detection is compared against the state-of-the-art technique on three different network datasets, namely CTU-IoT, CTU-13 and UNSW-NB15. Evaluations not only show the effectiveness and high performance of the proposed system on all three datasets but also demonstrate the generalizability of the newly proposed attribute correlations and combination strategies.