A Graph Clustering-Based Network Anomaly Detection System

Considering the Activity and Event Network model, also known as AEN, a recent knowledge graph model adept at handling the uncertain and dynamic nature of network activities, this paper proposes an unsupervised anomaly detection system, whose technique is foster around graph clustering within the AEN framework. The goal is to recognize and adapt to normal behaviour across different varying time periods while establishing the baseline behaviours for each cluster. The effectiveness of our proposed system in identifying the anomalies resulted in a false positive rate of 0.85% and a detection rate of 81 %, assessed using the CIC 2018 IDS dataset.