# Combining Unsupervised Approaches for Near Real-Time Network Traffic Anomaly Detection
## 5 Conclusions  
The present work analyzes the state of the art of Anomaly Detection systems and how innovative Machine Learning algorithms can be used for this purpose. In particular, the study of Anomaly Detection systems has been guided by the application focus examined; i.e., identifying near real-time anomalous behaviors within a network. Therefore, such analysis has been focused on unsupervised Machine Learning algorithms, which allow the detection of anomalous network traffic, knowing only the traffic of normal network activities. In fact, unlike supervised approaches, it is unnecessary to have, and often not possible to create, a training dataset that contains all the cyber attacks one wants to detect for network anomaly detection systems. Referring to the state of the art, three new Anomaly Detection algorithms have been developed in the present work, which combines Unsupervised Learning and Deep Learning techniques to detect in near real-time anomalous behaviors in a network. The excellent results obtained in the evaluation phase of these proposals affirm that the proposed Anomaly Detection algorithms can detect cyberattacks by analyzing the network traffic, improving the performance of their original components. From the results reported in Section 4.3, it can be seen that the proposed algorithms, when used to analyze the KDDCUP99, NSL-KDD and CIC-IDS2017 datasets, improve the performance of their respective base algorithms. Moreover, the MemAE-EIF algorithm obtained the highest values for both the precision index and the F1-score ratio for all the examined datasets. The Deep Learning algorithms used have a higher prediction speed than tree-based algorithms such as Extended Isolation Forest. On the other hand, algorithms such as Extended Isolation Forest achieve outstanding performance in anomaly detection. In the proposed algorithms, the prediction time is equivalent to the time taken by the Deep Learning algorithm in the presence of normal samples, while when suspicious samples are detected, it is necessary to add the time taken to extract the new features and the time taken by the EIF algorithm to compute the anomaly score. The algorithms employ an analysis time that allows the use of the Anomaly Detection models built to analyze in near real-time the network traffic, maximizing the performance in Anomaly Detection and thus obtaining an optimal compromise between temporal performance and the performance of the classification itself. The prediction time of the anomaly score used by each algorithm presented makes it possible to use the proposed Anomaly Detection models to analyze in near real-time the network traffic. The increase obtained in the classification scores permits, in a real-world context, the elimination of many alerts that would have occurred on large volumes of network traffic. Furthermore, assuming that in a real context, the traffic is mainly composed of connections that can be traced back to network activities considered normal, the algorithms proposed in the present work can achieve a prediction time that tends towards the time taken by the Deep Learning algorithm to identify suspicious samples. However, this approach has some limitations: it is necessary to have GPU hardware to make the inference, which makes it difficult to apply directly on devices such as routers, but requiring analysis servers or dedicated hardware; it is also necessary to take into account strict memory constraints and high computation times for the Extended Isolation Forest algorithm, as it is not parallelizable. Future research directions are oriented to testing the system on other datasets, in particular in a cross-dataset way (i.e., train, for example, the thresholds with a dataset and test with a second dataset, obviously taking into account the constraints due to keeping the same features or a subset of these) in order to evaluate the generalization capability of the system. Methodology, software, writing--original draft preparation: F.C., A.I. ; Conceptualization, validation: V.D., S.G., D.I., G.P.