Constant evolution and the emergence of new cyberattacks require the
development of advanced techniques for defense. This paper aims to measure the
impact of a supervised filter (classifier) in network anomaly detection. We
perform our experiments by employing a hybrid anomaly detection approach in
network flow data. For this purpose, we extended a state-of-the-art
autoencoder-based anomaly detection method by prepending a binary classifier
acting as a prefilter for the anomaly detector. The method was evaluated on the
publicly available real-world dataset UGR'16. Our empirical results indicate
that the hybrid approach does offer a higher detection rate of known attacks
than a standalone anomaly detector while still retaining the ability to detect
zero-day attacks. Employing a supervised binary prefilter has increased the AUC
metric by over 11%, detecting 30% more attacks while keeping the number of
false positives approximately the same.

本研究旨在评估监督过滤器在网络异常检测中的影响，通过在网络流数据中采用混合异常检测方法来进行实验。实证结果表明，与独立异常检测器相比，采用混合方法可以更高检测出已知攻击，并能侦测新型攻击，分别通过增加 AUC 度量指标 11% 和检测 30% 更多的攻击，同时保持误报率不变。

评估有监督分类过滤器对基于流的混合网络异常检测的影响

Assessing the Impact of a Supervised Classification Filter on Flow-based  Hybrid Network Anomaly Detection

In the prevailing convergence of traditional infrastructure-based deployment
(i.e., Telco and industry operational networks) towards evolving deployments
enabled by 5G and virtualization, there is a keen interest in elaborating
effective security controls to protect these deployments in-depth. By
considering key enabling technologies like 5G and virtualization, evolving
networks are democratized, facilitating the establishment of point presences
integrating different business models ranging from media, dynamic web content,
gaming, and a plethora of IoT use cases. Despite the increasing services
provided by evolving networks, many cybercrimes and attacks have been launched
in evolving networks to perform malicious activities. Due to the limitations of
traditional security artifacts (e.g., firewalls and intrusion detection
systems), the research on digital forensic data analytics has attracted more
attention. Digital forensic analytics enables people to derive detailed
information and comprehensive conclusions from different perspectives of
cybercrimes to assist in convicting criminals and preventing future crimes.
This chapter presents a digital analytics framework for network anomaly
detection, including multi-perspective feature engineering, unsupervised
anomaly detection, and comprehensive result correction procedures. Experiments
on real-world evolving network data show the effectiveness of the proposed
forensic data analytics solution.

5G 和虚拟化等关键技术在网络部署中的使用引起了对安全控制的关注，该研究论述了网络异常检测的数字取证数据分析框架的有效性。

演化网络中异常检测的取证数据分析

Forensic Data Analytics for Anomaly Detection in Evolving Networks

Network anomaly detection aims to find network elements (e.g., nodes, edges,
subgraphs) with significantly different behaviors from the vast majority. It
has a profound impact in a variety of applications ranging from finance,
healthcare to social network analysis. Due to the unbearable labeling cost,
existing methods are predominately developed in an unsupervised manner.
Nonetheless, the anomalies they identify may turn out to be data noises or
uninteresting data instances due to the lack of prior knowledge on the
anomalies of interest. Hence, it is critical to investigate and develop
few-shot learning for network anomaly detection. In real-world scenarios, few
labeled anomalies are also easy to be accessed on similar networks from the
same domain as of the target network, while most of the existing works omit to
leverage them and merely focus on a single network. Taking advantage of this
potential, in this work, we tackle the problem of few-shot network anomaly
detection by (1) proposing a new family of graph neural networks -- Graph
Deviation Networks (GDN) that can leverage a small number of labeled anomalies
for enforcing statistically significant deviations between abnormal and normal
nodes on a network; and (2) equipping the proposed GDN with a new cross-network
meta-learning algorithm to realize few-shot network anomaly detection by
transferring meta-knowledge from multiple auxiliary networks. Extensive
evaluations demonstrate the efficacy of the proposed approach on few-shot or
even one-shot network anomaly detection.

本研究探讨了采用少量标注异常来进行网络异常检测的问题，并提出一种新的图神经网络方法和跨网络元学习算法来解决这个问题，并通过大量实验验证了其有效性。