ANOMALY DETECTION IN NETWORK TRAFFIC USING A HYBRID MODEL OF K-MEANS CLUSTERING AND AUTOENCODERS

ABSTRACT Anomaly detection is generally understood to refer to rare objects, events or observations that deviate significantly from the bulk of the data and do not conform to well-defined notions of normal practice. The model uses the k-means power of clustering to identify potential anomalies based on the distance between cluster centroids and optimizes the search by using an autoencoder to detect reconstruction errors and then, hybrid method combining kmeans and autoencoder, compared with individual methods . The model was tested on realtime network traffic data collected through Wireshark, which demonstrated its effectiveness in detecting anomalous networks. KMeans and Autoencoders have been shown to perform well in detecting anomalies in network traffic, where both methods show the same number of anomalies and in addition, the hybrid method detects fewer anomalies and outperforms both KMeans and Autoencoders. Keywords: Anomaly detection, K-Means, cyber security, autoencoders.