# Novelty Detection in Network Traffic: Using Survival Analysis for Feature Identification

arXiv: https://arxiv.org/abs/2301.06229 · HTML: https://mlsanity.com/paper/2301.06229/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 2 of its 22 references that are in the map.
- First posted on arXiv 16 Jan 2023.

## Builds on (most cited first, 2 of 2)

- [LuNet: A Deep Neural Network for Network Intrusion Detection](https://mlsanity.com/paper/1909.10031/) (2019)
- [DANTE: Predicting Insider Threat using LSTM on system logs](https://mlsanity.com/paper/2102.05600/) (2021)

## Built on by (most cited first, 3 of 3)

- [Detecting Unknown Attacks in IoT Environments: An Open Set Classifier for Enhanced Network Intrusion Detection](https://mlsanity.com/paper/2309.07461/) (2023)
- [A Synergistic Approach In Network Intrusion Detection By Neurosymbolic AI](https://mlsanity.com/paper/2406.00938/) (2024)
- [Accurate Evaluation of Quickest Changepoint Detectors via Non-parametric Survival Analysis](https://mlsanity.com/paper/2605.18798/) (2026)

## Abstract (arXiv)

Intrusion Detection Systems are an important component of many organizations' cyber defense and resiliency strategies. However, one downside of these systems is their reliance on known attack signatures for detection of malicious network events. When it comes to unknown attack types and zero-day exploits, modern Intrusion Detection Systems often fall short. In this paper, we introduce an unconventional approach to identifying network traffic features that influence novelty detection based on survival analysis techniques. Specifically, we combine several Cox proportional hazards models and implement Kaplan-Meier estimates to predict the probability that a classifier identifies novelty after the injection of an unknown network attack at any given time. The proposed model is successful at pinpointing PSH Flag Count, ACK Flag Count, URG Flag Count, and Down/Up Ratio as the main features to impact novelty detection via Random Forest, Bayesian Ridge, and Linear Support Vector Regression classifiers.