Heterogeneous anomaly detection from network traffic streams using data summarization

The extreme volumes of modern networks and the increasing demands on security professionals present a critical need for analysis efficiency. Network anomaly summarization combines the broad threat detection characteristics of anomaly detection with the big data reducing qualities of summarization. However, summarising anomalies from network traffic data streams presents numerous obstacles. This thesis proposes a novel attack to anomaly mapping technique for heterogeneous network threat classification and provides a novel auto-encoding latent reflection approach for summarising network anomalies. Key findings include several new heterogeneous anomaly variants, promising performance of the novel summarization method, and the shortcomings of existing evaluation metrics