# Forensic Data Analytics for Anomaly Detection in Evolving Networks

arXiv: https://arxiv.org/abs/2308.09171 · HTML: https://mlsanity.com/paper/2308.09171/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 13 of its 59 references that are in the map.
- First posted on arXiv 17 Aug 2023.

## Builds on (most cited first, 13 of 13)

- [AutoML: A Survey of the State-of-the-Art](https://mlsanity.com/paper/1908.00709/) (2019)
- [On Hyperparameter Optimization of Machine Learning Algorithms: Theory and Practice](https://mlsanity.com/paper/2007.15745/) (2020)
- [Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset](https://mlsanity.com/paper/1811.00701/) (2018)
- [MTH-IDS: A Multi-Tiered Hybrid Intrusion Detection System for Internet of Vehicles](https://mlsanity.com/paper/2105.13289/) (2021)
- [A Lightweight Concept Drift Detection and Adaptation Framework for IoT Data Streams](https://mlsanity.com/paper/2104.10529/) (2021)
- [Tree-based Intelligent Intrusion Detection System in Internet of Vehicles](https://mlsanity.com/paper/1910.08635/) (2019)
- [Multi-Stage Optimized Machine Learning Framework for Network Intrusion Detection](https://mlsanity.com/paper/2008.03297/) (2020)
- [PWPAE: An Ensemble Framework for Concept Drift Adaptation in IoT Data Streams](https://mlsanity.com/paper/2109.05013/) (2021)
- [A Transfer Learning and Optimized CNN Based Intrusion Detection System for Internet of Vehicles](https://mlsanity.com/paper/2201.11812/) (2022)
- [Detecting Botnet Attacks in IoT Environments: An Optimized Machine Learning Approach](https://mlsanity.com/paper/2012.11325/) (2020)
- [Detecting Anomalous User Behavior Using an Extended Isolation Forest Algorithm: An Enterprise Case Study](https://mlsanity.com/paper/1609.06676/) (2016)
- [Optimized Random Forest Model for Botnet Detection Based on DNS Queries](https://mlsanity.com/paper/2012.11326/) (2020)
- [Scalable and Incremental Learning of Gaussian Mixture Models](https://mlsanity.com/paper/1701.03940/) (2017)

## Abstract (arXiv)

In the prevailing convergence of traditional infrastructure-based deployment (i.e., Telco and industry operational networks) towards evolving deployments enabled by 5G and virtualization, there is a keen interest in elaborating effective security controls to protect these deployments in-depth. By considering key enabling technologies like 5G and virtualization, evolving networks are democratized, facilitating the establishment of point presences integrating different business models ranging from media, dynamic web content, gaming, and a plethora of IoT use cases. Despite the increasing services provided by evolving networks, many cybercrimes and attacks have been launched in evolving networks to perform malicious activities. Due to the limitations of traditional security artifacts (e.g., firewalls and intrusion detection systems), the research on digital forensic data analytics has attracted more attention. Digital forensic analytics enables people to derive detailed information and comprehensive conclusions from different perspectives of cybercrimes to assist in convicting criminals and preventing future crimes. This chapter presents a digital analytics framework for network anomaly detection, including multi-perspective feature engineering, unsupervised anomaly detection, and comprehensive result correction procedures. Experiments on real-world evolving network data show the effectiveness of the proposed forensic data analytics solution.