# Detecting Abnormal Traffic in Large-Scale Networks

arXiv: https://arxiv.org/abs/2008.05791 · HTML: https://mlsanity.com/paper/2008.05791/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Aug 2020.

## Built on by (most cited first, 3 of 3)

- [FGAN: Federated Generative Adversarial Networks for Anomaly Detection in Network Traffic](https://mlsanity.com/paper/2203.11106/) (2022)
- [SincVAE: A new semi-supervised approach to improve anomaly detection on EEG data using SincNet and variational autoencoder](https://mlsanity.com/paper/2406.17537/) (2024)
- [GTCN-G: A Residual Graph-Temporal Fusion Network for Imbalanced Intrusion Detection](https://mlsanity.com/paper/2510.07285/) (2025)

## Abstract (arXiv)

With the rapid technological advancements, organizations need to rapidly scale up their information technology (IT) infrastructure viz. hardware, software, and services, at a low cost. However, the dynamic growth in the network services and applications creates security vulnerabilities and new risks that can be exploited by various attacks. For example, User to Root (U2R) and Remote to Local (R2L) attack categories can cause a significant damage and paralyze the entire network system. Such attacks are not easy to detect due to the high degree of similarity to normal traffic. While network anomaly detection systems are being widely used to classify and detect malicious traffic, there are many challenges to discover and identify the minority attacks in imbalanced datasets. In this paper, we provide a detailed and systematic analysis of the existing Machine Learning (ML) approaches that can tackle most of these attacks. Furthermore, we propose a Deep Learning (DL) based framework using Long Short Term Memory (LSTM) autoencoder that can accurately detect malicious traffics in network traffic. We perform our experiments in a publicly available dataset of Intrusion Detection Systems (IDSs). We obtain a significant improvement in attack detection, as compared to other benchmarking methods. Hence, our method provides great confidence in securing these networks from malicious traffic.