Anomaly detection on edge networks

Sammanfattning

Network anomaly detection is an active research area, with numerous solutions that utilize statistical methods, neural networks, and other machine learning methods. Autoencoders, in particular, have shown great performance by learning representations solely from benign traffic, enabling the detection of zero-day attacks. In this thesis, we propose a methodology that uses transfer learning to train autoencoders specifically tailored to individual network devices, thereby improving detection performance over general autoencoder models trained on aggregated network data. Furthermore, benchmarking results indicate that the lightweight device-specific model is suitable for inference on resource-constrained devices, suggesting its feasibility for real-time anomaly detection on edge devices. We compare the device-specific model with the general model by evaluating them against 12 different attack types. The results demonstrate that the proposed method shows promise in improving the anomaly detection performance. The device-specific model outperforms the general model for certain attacks, while achieving similar performance in others.