用集合结构改进隔离森林，更准发现网络扫描异常
siForest: Detecting Network Anomalies with Set-Structured Isolation Forest
- 将相同IP的扫描行为视为集合整体，提升异常检测精度
- 在模拟数据上表现优于传统方法，尤其擅长识别复杂扫描模式
- 适合网络安全团队用于大规模网络流量异常监测
随着网络攻击日益复杂和规模化，精准检测异常网络行为已成为保障网络安全的关键。现代系统需每日分析数十亿次网络交互以识别潜在威胁，因此高效准确的异常检测算法至关重要。本文研究了隔离森林（iForest）变体在互联网扫描数据中的应用，提出一种新型方法——集合划分隔离森林（siForest），专门用于处理具有集合结构的数据。通过将同一IP地址的多条扫描记录视为一个整体单元，siForest有效应对复杂多维数据的分析挑战。在模拟多种异常场景的合成数据集上进行的大量实验表明，siForest在部分类型的互联网扫描数据中具备超越传统方法的潜力。
原文摘要 · Abstract (English)
As cyber threats continue to evolve in sophistication and scale, the ability to detect anomalous network behavior has become critical for maintaining robust cybersecurity defenses. Modern cybersecurity systems face the overwhelming challenge of analyzing billions of daily network interactions to identify potential threats, making efficient and accurate anomaly detection algorithms crucial for network defense. This paper investigates the use of variations of the Isolation Forest (iForest) machine learning algorithm for detecting anomalies in internet scan data. In particular, it presents the Set-Partitioned Isolation Forest (siForest), a novel extension of the iForest method designed to detect anomalies in set-structured data. By treating instances such as sets of multiple network scans with the same IP address as cohesive units, siForest effectively addresses some challenges of analyzing complex, multidimensional datasets. Extensive experiments on synthetic datasets simulating diverse anomaly scenarios in network traffic demonstrate that siForest has the potential to outperform traditional approaches on some types of internet scan data.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。