Clustering-Assisted Classification: A DBSCAN-FNN Model for Anomaly Detection

This study investigates the integration of a density-based spatial clustering of application with noise (DBSCAN) and a feedforward neural network (FNN) for anomaly detection in computer network traffic. The Kyoto 2006+ dataset, containing real network traffic records, was used for model development and evaluation. Feature selection and scaling methods were applied to reduce redundancy, mitigate multicollinearity, and improve the stability of the models. DBSCAN was employed to identify clusters and noise within the traffic data, and the resulting cluster-based information was incorporated as an additional input feature for FNN classification. To evaluate the individual and combined effects of the DBSCAN-generated feature and network architecture, four configurations were investigated: FNN (8-8-1), FNN (8-9-1), DBSCAN-FNN (9-8-1), and DBSCAN-FNN (9-9-1). Experimental results showed that increasing network capacity alone produced only marginal changes in classification performance, while DBSCAN-generated feature improved recall and reduced the number of false negatives. DBSCAN-FNN (9-9-1) architecture achieved the highest accuracy, recall and an F1. The results indicate that observed performance improvements cannot be attributed exclusively to DBSCAN-generated feature or the network architecture. Instead, the findings suggest that clustering-derived information can complement conventional input features and, when combined with an appropriate network configuration, enhance FNN-based anomaly detection.