# Combining Unsupervised Approaches for Near Real-Time Network Traffic Anomaly Detection
## 2 Related Work  
Anomaly Detection systems using a supervised approach achieve high performance, which translates into a very low false alarm rate and a very high detection rate of cyberattacks. Some of the most classical classification algorithms used for this purpose are Random Forest [4], Support Vector Machine [5], and feed-forward neural networks [6]. However, these approaches require a priori knowledge of the attacks to be detected. In [7], an algorithm called Ensemble Consensus is proposed, which combines three of the main unsupervised algorithms to detect anomalies present in network traffic. The algorithms that make up Ensemble Consensus are Isolation Forest [8], Local Outlier Factor [9], and Elliptic Envelope [10]. The Ensemble Consensus algorithm is tested using KDDCUP99 as the reference dataset. The reported results show that the Ensemble Consensus algorithm achieves comparable performance with supervised algorithms such as Random Forest or Support Vector Machine. [PERSON] et al. [11] compare stacked-autoencoders with various unsupervised learning algorithms such as one-class SVM, Isolation forest, and others for dimensionality reduction and classification by achieving high F1-score values compared to supervised methods. A comparison of various deep learning algorithms such as Convolutional Neural Networks (CNN) and Recurrent Neural Networks (RNNs) such as Long Short Term Memory (LSTM) and Gated Recurrent Unit (GRU) network is instead proposed by [PERSON] et al. [12] and used to find zero-day anomalies within an IoT network with a False Acceptance Rate (FAR) ranging from 0.23% to 7.98%. [PERSON] et al. [13] use various unsupervised learning algorithms and compare them with a model built through the Kalman filter. Such a model achieved unexpected results with values above 97.02% accuracy. An updated and detailed review on anomaly detection techniques to detect intrusions and attacks is contained in [14]. Another review of no less importance and clarifying the state of the art, the domain of interest, and the types of attacks is offered in [15]. [PERSON] et al. [16] propose the Extended Isolation Forest algorithm, which aims to solve some issues identified in the Isolation Forest algorithm. The Isolation Forest algorithm is one of the most robust and widely used Anomaly Detection algorithms and achieves good performance when used to detect attacks contained in the KDDCUP99 dataset. Isolation Forest relies on randomness in the selection of features and values. Because outliers are \"few and far between\", they stand out quickly from these random selections. Branch cuts are always horizontal or vertical, introducing distortion and artifacts into the anomaly score map. There is no fundamental aspect of the algorithm that requires this restriction to select a branch cut with a random \"slope\" at each branch point. Like the standard Isolation Forest algorithm, anomalies can be isolated quickly, whereas regular points require the isolation of many branch cuts. More recent Anomaly Detection systems use Deep Learning techniques to detect anomalies. Some of the most promising work uses autoencoder-type neural networks to learn the normal behavior of network traffic. Some of the algorithms researched for this purpose are given below. The idea behind the work presented in [17] concerns the use of a deep autoencoder-type neural network to learn the data describing the regular network traffic to be monitored. Through the constructed model, such Anomaly Detection systems can analyze network traffic and report traffic that deviates from the data learned in the training phase as anomalous. [PERSON] et al. [18] propose an unsupervised algorithm called Deep Autoencoding Gaussian Mixture Model, which uses in combination a Deep Autoencoder neural network with Gaussian Mixture Model (GMM). In [18], it is used on the KDDCUP99 and NSL-KDD datasets, and for both datasets used, the DAGMM algorithm performed numerically very well.