Anomaly detection at the subnetwork level: traffic classification for machine learning algorithms

Abstract In this paper we propose a traffic classification methodology for subnetwork level anomaly detection using machine learning algorithms. Our proposed techniques allow researchers and practitioners in the field to classify the corresponding traffic multiplex constituents (subnetworks) according to their predictability level beforehand. Subnetworks deemed as predictable yield smaller prediction error than the rest, under well-known machine learning prediction algorithms, such as ANN, GRU and LSTM. Thus, such predictability features makes the former better suited for anomaly detection purposes, that are based on deviations from predicted values, while the rest are prone to produce false positives.