An Enhanced Fuzzy ARTMAP Clustering for Network Traffic Anomaly Detection

¹ School of Computing and Creative Media, University of Technology Sarawak, Malaysia
² Design and Technology Centre, University of Technology Sarawak, Malaysia
³ Advanced Centre for Sustainability Socio-Economic and Technological Development, University of Technology Sarawak, Malaysia

^* Corresponding author: This email address is being protected from spambots. You need JavaScript enabled to view it.

Abstract

Clustering models have been popular to cluster network traffic data, aiming to reveal the hidden data network traffic patterns for anomalous activities among a predetermined number of clusters. The typical batch learning in clustering implements static number of clusters, which often leads to the difficulty of determining an optimum number of clusters. Catastrophic forgetting occurs when the model is relearned from scratch with a new predetermined number of clusters for adopting newly added data patterns. Consequently, previously acquired forensic results in the previous model are forgotten, prompting challenges to maintain forensic transparency over time. In this paper, an enhanced Fuzzy ARTMAP clustering model, aims to continuously adopt and identify network traffic anomaly data patterns, while retaining previously acquired knowledge, over time is proposed. It is associated with a log-squashed transformation on top of the original Min-Max scaling normalization to reveal the micro-flow patterns from heavy-tailed distributions. Moreover, a delayed pruning strategy is integrated to mitigate category/cluster proliferation, caused by the dynamically increased number of clusters when adapting new data. Finally, the Fuzzy ARTMAP algorithm is implemented to incrementally cluster the data patterns. The proposed model is experimented with a curated CICIDS-2017 dataset, and it demonstrates that the model succeeds in clustering 28,000 data patterns into only 502 clusters, while maintaining high precision on high-volume attack data patterns among the clusters.