Summary
Detecting anomalous traffic provides one approach to network security threat detection. In this white paper we propose a behavior-based anomaly detection method that detects anomalous traffic by applying a threshold to a reconstruction error given by the LSTM AutoEncoder model on the Bro conn log data collected as time series data.
What is in it for you?
The experimental results in the white paper show that the use of Bro connection logs and extracting only features that significantly contribute to intrusion detection gives promising results.