Unsupervised Online Learning for Network Flow Anomaly Detection: A Comparative Evaluation
摘要
Anomaly detection in network traffic is a crucial task for ensuring the security and integrity of communication systems. Traditional supervised machine learning models often achieve high accuracy but rely heavily on labeled datasets, which are costly to obtain and may become outdated. To address this limitation, this paper explores the use of unsupervised and online learning techniques for anomaly detection in network flow data. In this work, we compare three approaches: a baseline exact-match dictionary method, a supervised Decision Tree classifier, and an online One-Class SVM implemented using the River framework. The evaluation is performed on a real-world NetFlow-based dataset enriched with synthetic anomalies to simulate realistic threat scenarios. Results indicate that the online One-Class SVM achieves a high detection rate (recall = 0.9861) with a low false positive rate (FPR = 0.0118), highlighting its suitability for dynamic environments where adaptability and low maintenance are critical. This study demonstrates the potential of online unsupervised learning as a practical alternative to traditional models in network anomaly detection tasks.