标题： 评估监督分类过滤器对基于流量的混合网络异常检测的影响 显示英文标题

标题： Assessing the Impact of a Supervised Classification Filter on Flow-based Hybrid Network Anomaly Detection

摘要： 持续的演变和新型网络攻击的出现要求开发先进的防御技术。 本文旨在衡量监督过滤器（分类器）在网络异常检测中的影响。 我们通过在网络流量数据中采用混合异常检测方法来进行实验。 为此，我们通过在基于自动编码器的最新异常检测方法前添加一个二进制分类器作为异常检测器的预过滤器来扩展该方法。 该方法在公开的现实世界数据集 UGR'16 上进行了评估。 我们的实证结果表明，混合方法在保持检测零日攻击能力的同时，比独立的异常检测器具有更高的已知攻击检测率。 使用监督二进制预过滤器使 AUC 指标提高了超过 11%，检测到的攻击增加了 30%，同时保持误报数量大致相同。 显示英文摘要

摘要： Constant evolution and the emergence of new cyberattacks require the development of advanced techniques for defense. This paper aims to measure the impact of a supervised filter (classifier) in network anomaly detection. We perform our experiments by employing a hybrid anomaly detection approach in network flow data. For this purpose, we extended a state-of-the-art autoencoder-based anomaly detection method by prepending a binary classifier acting as a prefilter for the anomaly detector. The method was evaluated on the publicly available real-world dataset UGR'16. Our empirical results indicate that the hybrid approach does offer a higher detection rate of known attacks than a standalone anomaly detector while still retaining the ability to detect zero-day attacks. Employing a supervised binary prefilter has increased the AUC metric by over 11%, detecting 30% more attacks while keeping the number of false positives approximately the same.