Performance of Flow-based Anomaly Detection in Sampled Traffic

This is the authors' abstract. We don't add key points for this paper.

In recent years, flow-based anomaly detection has considerable attention from many researchers and methods have been proposed to improve its accuracy., only a few studies have considered anomaly with sampled flow traffic, which is widely used for management of high-speed networks. This gap is in this study. First, we optimize an artificial network (ANN)-based classifier to detect anomalies flow traffic. The results show that although it has a high of accuracy, the classifier loses significant in the process of sampling. In this regard, we a sampling method to improve the performance of-based anomaly detection in sampled traffic. While sampling methods for anomaly detection preserve small malicious flows, the proposed algorithm samples small and large malicious flows. Therefore, the rate of the flow-based anomaly detector is by about 5% using our algorithm. To evaluate the sampling method, three flow-based datasets are in this study.