Leveraging Deep Learning for Network Anomaly Detection

Novel cybersecurity solutions tend to adopt new mechanisms from emerging fields in order to confront zero-day attacks and unknown signature threats. Deep learning techniques have attracted the interest of the cybersecurity domain, as they offer the flexibility to be trained for various objects and targets, amongst them network anomaly detection. Traditional network anomaly detection methods rely on predefined threats signature pattern, whereas deep learning ones can combine different attributes of network flows and packet payloads. In this paper a deep learning-based method for network anomaly detection is presented in the frame of the PALANTIR project. PALANTIR aims to develop an end-to-end cybersecurity solution for SMEs, providing virtualized security services for various attack threats. Regarding the current study, the proposed deep learning method was evaluated for its accuracy on two widely used security databases, performing anomaly detection, while performing flow monitoring. The developed framework shows promising results in terms of accuracy and sets the steppingstone for further adoption of deep learning mechanisms in the cybersecurity field.