Robust Variational Autoencoders and Normalizing Flows for Unsupervised Network Anomaly Detection

Conference: The 36th International Conference on Advanced Information Networking and Applications, AINA 2022.
Authors: N. Najari, S. Berlemont, G. Lefebvre, S. Duffner and C. Garcia
DOI: 10.1007/978-3-030-99587-4_24
Links: Paper, Preprint, Presentation, Bibtex

Abstract:

In recent years, the integration of connected devices in smart homes has significantly increased, thanks to the advent of the Internet of things (IoT). However, these IoT devices introduce new security challenges, since any anomalous behavior has a serious impact on the whole network. Network anomaly detection has always been of considerable interest for every actor in the network landscape. In this paper, we propose GRAnD, an algorithm for unsupervised anomaly detection. Based on Variational Autoencorders and Normalizing Flows, GRAnD learns from network traffic metadata a normal profile representing the expected nominal behavior of the network. Then, this model is optimized to detect anomalies. Unlike existing anomaly detectors, our method is robust to the hyperparameter selection and outliers contaminating the training data. Extensive experiments and sensitivity analyses on public network traffic benchmark datasets demonstrate the effectiveness of our approach in network anomaly detection.