Anomaly detection in network traffic using unsupervised machine learning approach

Abstract: A sudden spike or dip in a metric is an anomalous behaviour and both the cases needs attention. Detection of anomaly can be solved by supervised learning algorithms if we have information on anomalous behaviour before modelling, but initially without feedback it’s difficult to identify that points. Anomaly detection is important and finds its application in various domains like detection of fraudulent bank transactions, network intrusion detection, sudden rise/drop in sales, change in customer behaviour, etc. So we model this as an unsupervised problem using algorithms like Isolation Forest, One class SVM and LSTM. Here we are identifying anomalies using isolation forest.