Constant evolution and the emergence of new cyberattacks require the
development of advanced techniques for defense. This paper aims to measure the
impact of a supervised filter (classifier) in network anomaly detection. We
perform our experiments by employing a hybrid anomaly detection approach in
network flow data. For this purpose, we extended a state-of-the-art
autoencoder-based anomaly detection method by prepending a binary classifier
acting as a prefilter for the anomaly detector. The method was evaluated on the
publicly available real-world dataset UGR'16. Our empirical results indicate
that the hybrid approach does offer a higher detection rate of known attacks
than a standalone anomaly detector while still retaining the ability to detect
zero-day attacks. Employing a supervised binary prefilter has increased the AUC
metric by over 11%, detecting 30% more attacks while keeping the number of
false positives approximately the same.

本研究旨在评估监督过滤器在网络异常检测中的影响，通过在网络流数据中采用混合异常检测方法来进行实验。实证结果表明，与独立异常检测器相比，采用混合方法可以更高检测出已知攻击，并能侦测新型攻击，分别通过增加 AUC 度量指标 11% 和检测 30% 更多的攻击，同时保持误报率不变。