Autoencoder Based Unsupervised Network Traffic Anomaly Detection on Pseudo Time Series Data

Network anomaly detection is a critical task for ensuring cybersecurity in dynamic traffic environments. Traditional methods, such as correlation-based or statistical rule-driven detection, often depend on labelled data or fixed thresholds, which limit adaptability and scalability. These approaches struggle with non-Gaussian patterns, threshold rigidity, and high false alarms in unlabelled or real-time traffic. To overcome these challenges, we propose an Autoencoder-based unsupervised learning model that detects anomalies through reconstruction error patterns in pseudo time-series IP traffic. Our method adapts dynamically using percentile-based thresholding and error smoothing, removing the need for predefined thresholds or labelled anomalies, and effectively detecting both service failure and traffic surge anomalies. The model demonstrated exceptional performance across both anomaly types. It consistently achieved 99 to 100 percent accuracy, precision, recall, and F1-scores as test sizes scaled from 50 to 100000 samples. Even at large test sizes, the model maintained reliable detection with minimal false positives. High recall ensured nearly all injected anomalies were detected, while high precision minimized false alarms across all scales. Furthermore, we conducted a comparative evaluation against one traditional method’s Fast xFlow Proxy, which used correlation analysis and dynamic rule thresholds. Our Autoencoder model significantly outperformed it in detection accuracy, scalability, and generalization to different anomaly types. On average, the proposed Autoencoder framework achieved 99.91 percent accuracy in detecting service failure anomalies caused by traffic drops and 99.84 percent accuracy in detecting sudden traffic surges due to DDoS attacks. These results, obtained across multiple anomaly ratios and seven different test dataset sizes, confirm that our model consistently outperforms the Fast xFlow Proxy method in terms of accuracy, scalability, and robustness, establishing it as a highly effective solution for real-time unlabelled anomaly detection in modern cybersecurity systems.