{"id":21065,"date":"2017-10-04T07:12:49","date_gmt":"2017-10-04T05:12:49","guid":{"rendered":"https:\/\/www.inovex.de\/blog\/?p=3513"},"modified":"2022-11-30T12:58:09","modified_gmt":"2022-11-30T11:58:09","slug":"a-hybrid-supervisedunsupervised-approach-to-network-anomaly-detection","status":"publish","type":"post","link":"https:\/\/www.inovex.de\/de\/blog\/a-hybrid-supervisedunsupervised-approach-to-network-anomaly-detection\/","title":{"rendered":"A hybrid supervised\/unsupervised approach to network anomaly detection"},"content":{"rendered":"

The previous two posts gave a short introduction of network anomaly detection<\/a> in general. We also introduced the k-means algorithm<\/a> as a simple clustering technique and discussed some advantages and drawbacks of the algorithm. Furthermore we gave some general information about techniques other than clustering which can be used for anomaly detection. In this post we want to introduce a hybrid unsupervised\/supervised approach. We are going to use Balanced Iterative Reducing and Clustering using Hierarchies, also known as BIRCH as a pre-clustering step for a subsequent Support Vector Machine (SVM) classifier.<\/p>\n

Unfortunately we do not have a labeled data set of the inovex network traffic to train the classifier on. So we will first introduce the general structure of the hybrid approach and the result of the analysis of the NSL-KDD data set. Afterwards we are going to briefly introduce an adaptation of the hybrid approach which can also handle unlabeled data.<\/p>\n

\n

<\/p>\n<\/div>