Sparse Autoencoders for Unsupervised Netflow Data Classification

Abstract

The ongoing growth in the complexity of malicious software has rendered the long-established solutions for cyber attack detection inadequate. Specifically, at any time novel malware emerges, the conventional security systems prove inept until the signatures are brought up to date. Moreover, the bulk of machine-learning based solutions rely on supervised training, which generally leads to an added burden for the admin to label the network traffic and to re-train the system periodically. Consequently, the major contribution of this paper is an outline of an unsupervised machine learning approach to cybersecurity, in particular, a proposal to use sparse autoencoders to detect the malicious behaviour of hosts in the network. We put forward a means of botnet detection through the analysis of data in the form of Netflows for a use case.