# Multi-Perspective Content Delivery Networks Security Framework Using Optimized Unsupervised Anomaly Detection

arXiv: https://arxiv.org/abs/2107.11514 · HTML: https://mlsanity.com/paper/2107.11514/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 71 references that are in the map.
- First posted on arXiv 24 Jul 2021.

## Builds on (most cited first, 17 of 17)

- [On Hyperparameter Optimization of Machine Learning Algorithms: Theory and Practice](https://mlsanity.com/paper/2007.15745/) (2020)
- [MTH-IDS: A Multi-Tiered Hybrid Intrusion Detection System for Internet of Vehicles](https://mlsanity.com/paper/2105.13289/) (2021)
- [A Lightweight Concept Drift Detection and Adaptation Framework for IoT Data Streams](https://mlsanity.com/paper/2104.10529/) (2021)
- [Tree-based Intelligent Intrusion Detection System in Internet of Vehicles](https://mlsanity.com/paper/1910.08635/) (2019)
- [Soliciting Human-in-the-Loop User Feedback for Interactive Machine Learning Reduces User Trust and Impressions of Model Accuracy](https://mlsanity.com/paper/2008.12735/) (2020)
- [Multi-Stage Optimized Machine Learning Framework for Network Intrusion Detection](https://mlsanity.com/paper/2008.03297/) (2020)
- [Distance-Based Anomaly Detection for Industrial Surfaces Using Triplet Networks](https://mlsanity.com/paper/2011.04121/) (2020)
- [Bayesian Optimization with Machine Learning Algorithms Towards Anomaly Detection](https://mlsanity.com/paper/2008.02327/) (2020)
- [A Transfer Learning Framework for Anomaly Detection Using Model of Normality](https://mlsanity.com/paper/2011.06210/) (2020)
- [DNS Typo-squatting Domain Detection: A Data Analytics & Machine Learning Based Approach](https://mlsanity.com/paper/2012.13604/) (2020)
- [Ensemble-based Feature Selection and Classification Model for DNS Typo-squatting Detection](https://mlsanity.com/paper/2006.09272/) (2020)
- [Detecting Anomalous User Behavior Using an Extended Isolation Forest Algorithm: An Enterprise Case Study](https://mlsanity.com/paper/1609.06676/) (2016)
- [Multi-split Optimized Bagging Ensemble Model Selection for Multi-class Educational Data Mining](https://mlsanity.com/paper/2006.05031/) (2020)
- [Systematic Ensemble Model Selection Approach for Educational Data Mining](https://mlsanity.com/paper/2005.06647/) (2020)
- [Machine Learning for Performance-Aware Virtual Network Function Placement](https://mlsanity.com/paper/2001.07787/) (2020)
- [Scalable and Incremental Learning of Gaussian Mixture Models](https://mlsanity.com/paper/1701.03940/) (2017)
- [Simple Countermeasures to Mitigate the Effect of Pollution Attack in Network Coding Based Peer-to-Peer Live Streaming](https://mlsanity.com/paper/1707.07546/) (2017)

## Built on by (most cited first, 9 of 9)

- [PWPAE: An Ensemble Framework for Concept Drift Adaptation in IoT Data Streams](https://mlsanity.com/paper/2109.05013/) (2021)
- [IoT Data Analytics in Dynamic Environments: From An Automated Machine Learning Perspective](https://mlsanity.com/paper/2209.08018/) (2022)
- [A Transfer Learning and Optimized CNN Based Intrusion Detection System for Internet of Vehicles](https://mlsanity.com/paper/2201.11812/) (2022)
- [LCCDE: A Decision-Based Ensemble Framework for Intrusion Detection in The Internet of Vehicles](https://mlsanity.com/paper/2208.03399/) (2022)
- [Enabling AutoML for Zero-Touch Network Security: Use-Case Driven Analysis](https://mlsanity.com/paper/2502.21286/) (2025)
- [Towards Zero Touch Networks: Cross-Layer Automated Security Solutions for 6G Wireless Networks](https://mlsanity.com/paper/2502.20627/) (2025)
- [Toward Autonomous and Efficient Cybersecurity: A Multi-Objective AutoML-based Intrusion Detection System](https://mlsanity.com/paper/2511.08491/) (2025)
- [An Automated Data Engineering Pipeline for Anomaly Detection of IoT Sensor Data](https://mlsanity.com/paper/2109.13828/) (2021)
- [Anomaly Detection in Intra-Vehicle Networks](https://mlsanity.com/paper/2205.03537/) (2022)

## Abstract (arXiv)

Content delivery networks (CDNs) provide efficient content distribution over the Internet. CDNs improve the connectivity and efficiency of global communications, but their caching mechanisms may be breached by cyber-attackers. Among the security mechanisms, effective anomaly detection forms an important part of CDN security enhancement. In this work, we propose a multi-perspective unsupervised learning framework for anomaly detection in CDNs. In the proposed framework, a multi-perspective feature engineering approach, an optimized unsupervised anomaly detection model that utilizes an isolation forest and a Gaussian mixture model, and a multi-perspective validation method, are developed to detect abnormal behaviors in CDNs mainly from the client Internet Protocol (IP) and node perspectives, therefore to identify the denial of service (DoS) and cache pollution attack (CPA) patterns. Experimental results are presented based on the analytics of eight days of real-world CDN log data provided by a major CDN operator. Through experiments, the abnormal contents, compromised nodes, malicious IPs, as well as their corresponding attack types, are identified effectively by the proposed framework and validated by multiple cybersecurity experts. This shows the effectiveness of the proposed method when applied to real-world CDN data.