A Holistic review and performance evaluation of unsupervised learning methods for network anomaly detection

Abstract

Abstract The evolving cyber-attack landscape demands flexible and precise protection for information and networks. Network anomaly detection (NAD) systems play a crucial role in preventing and detecting abnormal activities on the network that may lead to catastrophic outcomes when undetected. This paper aims to provide a comprehensive analysis of NAD using unsupervised learning (UL) methods to evaluate the effectiveness of such systems. The paper presents a detailed overview of several UL techniques, lists the current developments and innovations in UL techniques for network anomaly and intrusion detection, and evaluates 13 unsupervised anomaly detection algorithms empirically on benchmark datasets such as NSL-KDD, UNSW-NB15, and CIC-IDS 2017 to analyze the performance of different classes of UL approaches for NAD systems. This study demonstrates the effectiveness of NAD algorithms, discusses UL approaches' research challenges, and unearths the potential drawbacks in the current network security environment.