Detection of Network Anomalies Using Unsupervised and Reinforcement Learning Models
摘要
There has been much research on Supervised Machine Learning for network intrusion detection. With Supervised Learning, the ground truth (in the form of labels for each sample) is known. In Unsupervised approaches, the labels are not known, so training involves finding similarities and differences to the extent that the samples can be clustered (or grouped). Clustering algorithms provide statistical techniques to accomplish classification of data into distinctive clusters. There are several methods of clustering. This research demonstrates and compares the algorithms of Kmeans, Kmeans++, DBSCAN, Latent-Class Gaussian Mixture, and Learning Automata Clustering (LAC). We show that LAC, a Reinforcement Learning algorithm, provides the highest accuracy (99.65%) for classifying the benign and malicious data samples. These results are promising for future research in Reinforcement Learning methods for network anomaly traffic detection.