An Unsupervised Based Enhanced Anomaly Detection Model Using Features Importance

Anomaly Detection, one of the important use cases of cybersecurity, allows us to know the out of distribution behavior of processes in the network which can help us to flag any kind of attack or issue on the network. Several works have been proposed in the literature that aim to detect anomalies based on supervised algorithms. However, they fail to detect zero-day attacks. Keeping this limitation in mind, in this work, we have proposed an anomaly detection model based upon features' importance. A newly introduced dataset called BETH is used for our anomaly detection research and we outperform the baseline scores using the existing Principal Component Analysis, Histogram and Clustering based approaches which performed really well with 0.96, 0.95 and 0.94 ROC-AUC scores respectively on the test set by selecting the features extracted through different approaches such as difference in metric and assignment of weights.