Combining MIC feature selection and feature-based MSPCA for network traffic anomaly detection

Abstract

In this paper, we propose a network anomaly detection system which consists of a Maximal Information Coefficient based feature selection algorithm and a feature-based MSPCA detection algorithm, which can separate the anomalous information more efficiently. Maximal Information Coefficient can provide a good information measurement of any dependency between two random variables. MSPCA combines the benefit of PCA and wavelet analysis to reduce the effect of normal subspace contamination, which is the main challenge of PCA-based anomaly detection algorithm. We utilize multiple network flow features to describe the network traffic instead of using only volumes. To evaluate our proposed system, we test it on the DARPA 1999 dataset. The results indicate a large improvement when using our method compared to PCA-based anomaly detection algorithms.