Identification of anomalous and malicious network communication patterns using unsupervised neural networks and deep learning

In this paper, a network traffic analysis project is described, starting from the management of input data, the elaboration of their structure and their organization making them the subject of our study. The purpose of this analysis is based on the anomaly detection problem, i.e., the analysis of network packets to understand which of the characteristics are crucial in differentiating benign from abnormal traffic, all using two different approaches. The first one is based on clustering used to classify and categorize network flows; all these classifications are shown with graphs to increase effectiveness and understanding, especially with the aim to notice the behaviour of the traffic network. After this data filtering stage, we move on to the actual classification of the data using machine learning and deep learning techniques; the choice falls on an unsupervised approach, i.e., one that does not involve labeling the data during network training, in this case, it must be the neural network itself that during the training phase must understand which of the data characteristics are needed to make optimal predictions. In this step, of course, we made use of a number of metrics and parameters for evaluating the performance of the neural network, based on which to estimate the correctness of its predictions.