# Unsupervised Abnormal Traffic Detection through Topological Flow Analysis

arXiv: https://arxiv.org/abs/2205.07109 · HTML: https://mlsanity.com/paper/2205.07109/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 4 of its 30 references that are in the map.
- First posted on arXiv 14 May 2022.

## Builds on (most cited first, 4 of 4)

- [PyOD: A Python Toolbox for Scalable Outlier Detection](https://mlsanity.com/paper/1901.01588/) (2019)
- [Graph-based Anomaly Detection and Description: A Survey](https://mlsanity.com/paper/1404.4679/) (2014)
- [LSCP: Locally Selective Combination in Parallel Outlier Ensembles](https://mlsanity.com/paper/1812.01528/) (2018)
- [Multi-centrality Graph Spectral Decompositions and their Application to Cyber Intrusion Detection](https://mlsanity.com/paper/1512.07372/) (2015)

## Abstract (arXiv)

Cyberthreats are a permanent concern in our modern technological world. In the recent years, sophisticated traffic analysis techniques and anomaly detection (AD) algorithms have been employed to face the more and more subversive adversarial attacks. A malicious intrusion, defined as an invasive action intending to illegally exploit private resources, manifests through unusual data traffic and/or abnormal connectivity pattern. Despite the plethora of statistical or signature-based detectors currently provided in the literature, the topological connectivity component of a malicious flow is less exploited. Furthermore, a great proportion of the existing statistical intrusion detectors are based on supervised learning, that relies on labeled data. By viewing network flows as weighted directed interactions between a pair of nodes, in this paper we present a simple method that facilitate the use of connectivity graph features in unsupervised anomaly detection algorithms. We test our methodology on real network traffic datasets and observe several improvements over standard AD.