# Combining Unsupervised Approaches for Near Real-Time Network Traffic Anomaly Detection
## 3 Proposed Approaches  
In the application context under consideration, in which the proposed system must detect the presence of abnormal traffic, it is necessary to maximize the accuracy index for the Anomaly Detection algorithm. Low precision involves many false positives, which represent the number of false alarms that a human operator must analyze. A high number of false positives can result in longer latencies for analyzing and responding to real cyberattacks in the monitored network. Therefore, it is necessary to use an algorithm that is oriented to maximize accuracy even if the recall index is penalized in some cases. To achieve these goals, three new algorithms are proposed in this section, which combines a basic algorithm (Deep Learning) with the Extended Isolation Forest. The basic algorithms identified are related to the class of autoencoders and are Deep Autoencoding Gaussian Mixture Model, Deep Autoencoder, and Memory-Augmented Deep Autoencoder, thus giving rise to the following algorithms:* Deep Autoencoding Gaussian Mixture Model with Extended Isolation Forest (DAGMM-EIF);
* Deep Autoencoder with Extended Isolation Forest (DA-EIF);
* Memory-augmented Deep Autoencoder with Extended Isolation Forest (MemAE-EIF). Stacked-autoencoders or deep autoencoders are multilevel neural networks built to create a subspace, called embedding, capable of capturing the significant pattern common to various instances. It can intuitively be compared to the vector subspace constructed by low-rank factorization by the singular value decomposition of a matrix. The main difference is that stacked-autoencoders are, due to the activation functions, nonlinear. Specifically, denoising stacked-autoencoders [25] introduce noise into the encoding, resulting in an encoding that is a corrupted version of the original input data. It is precisely the \"corrupted\" version of the data that is used to train the multilevel neural network, and thanks to the use of appropriate loss functions, the gradient descent optimization algorithm allows us to create a subspace (embedding) of lower dimensionality than the input that, however, captures the most important information to reconstruct the clean pre-image with the lowest possible error. The objective is to reproduce the original and undamaged version of the original information. By comparing the corrupted data to the original data, the network learns which data features are most important and which are unimportant/corrupted. In other words, for a model to denoise the damaged data, it must have extracted the important features of the data. In addition to the Deep Autoencoder algorithm, two evolutions of this algorithm were therefore considered. The DAGMM algorithm uses two Deep Autoencoder neural networks to learn the network traffic referable to network activities considered normal. The intuition behind the DAGMM algorithm concerns the training phase, in which the algorithm jointly optimizes the parameters of the autoencoder network and the GMM model in an end-to-end manner, exploiting a separate estimation network to facilitate the learning of the mixture model parameters [18]. On the other hand, the MemAE algorithm introduces a memory module into the autoencoder architecture to solve a simple autoencoder-type neural network problem. In [20], the author states that in some cases, the model built through an autoencoder can correctly reconstruct even samples that deviate from the training set records, which could cause the Anomaly Detection system to fail. In the algorithm's training phase, it is not necessary to have all the classes related to the detected  
Forest algorithm. Specifically, as can be seen from Figure 1, in the first step, the basic algorithm is used to predict the anomaly score on sample \(X\). If the score evaluated for sample \(X\) is greater than an anomaly threshold defined in the training phase, the sample is considered suspicious and must be analyzed with the EIF algorithm. Otherwise, the prediction process ends, and the analyzed sample is considered normal.