Are Network Attacks Outliers? A Study of Space Representations and Unsupervised Algorithms

摘要: Among network analysts, “anomaly” and “outlier” are terms commonly associated to attacks. Attacks outliers (or anomalies) in the sense that they exploit communication protocols with novel infiltration techniques against which there no defenses yet. But due dynamic heterogeneous nature of traffic, attacks may look like normal traffic variations. Also attackers try make indistinguishable from traffic. Then, actual anomalies? This paper tries answer this important question analytical perspectives. To end, we test outlierness a recent, complete dataset for evaluating Intrusion Detection by using five different feature vectors representation outlier ranking algorithms. In addition, craft new vector maximizes discrimination power outlierness. Results show significantly more than legitimate traffic—specially representations profile endpoints—, although attack non-attack distributions strongly overlap. Given spaces noisy density variations spaces, algorithms measure locally less effective global distance estimations. Our research confirms unsupervised methods suitable detection, but also must be combined leverage pre-knowledge prevent high false positive rates. findings expand basis detection.