Unsupervised Network Anomaly Detection in Real-Time on Big Data

Juliette Dromard (1) , Gilles Roudiere (1) , Philippe Owezarski (2)

1 LAAS - Laboratoire d'analyse et d'architecture des systèmes
2 LAAS-SARA - Équipe Services et Architectures pour Réseaux Avancés

Network anomaly detection relies on intrusion detection systems based on knowledge databases. However, building this knowledge may take time as it requires manual inspection of experts. Actual detection systems are unable to deal with 0-day attack or new user's behavior and in consequence they may fail in correctly detecting intrusions. Unsu-pervised network anomaly detectors overcome this issue as no previous knowledge is required. In counterpart, these systems may be very slow as they need to learn trac's pattern in order to acquire the necessary knowledge to detect anomalous ows. To improve speed, these systems are often only exposed to sampled trac, harmful trac may then avoid the detector examination. In this paper, we propose to take advantage of new distributed computing framework in order to speed up an Unsuper-vised Network Anomaly Detector Algorithm, UNADA. The evaluation shows that the execution time can be improved by a factor of 13 allowing UNADA to process large traces of trac in real time.

Domaines: Réseaux et télécommunications [cs.NI]; Calcul parallèle, distribué et partagé [cs.DC]

Juliette Dromard, Gilles Roudiere, Philippe Owezarski. Unsupervised Network Anomaly Detection in Real-Time on Big Data. New Trends in Databases and Information Systems, 539, Springer, pp.197-206, 2015, Communications in Computer and Information Science, 978-3-319-23200-3. ⟨10.1007/978-3-319-23201-0_22⟩. ⟨hal-01229003⟩