Data Fusion-Based Network Anomaly Detection towards Evidence Theory

We propose a fusion model of deep neural networks and traditional algorithms for anomaly detection. The proposed model inherits the advantages of both these methods to create a robust anomaly detection algorithm. We employ the Dempster-Shafer theory (D-S) of Evidence, a very reliable and flexible data fusion technique, to form a fusion-based network anomaly detection (FuseNAD) by applying a basic probability assignment (BPA) function and modifying the D-S theory's rule. FuseNAD fuses four anomaly detection methods consisting of a deep learning technique, namely Shrink Auto-Encoder, and three traditional ones such as One-class Support Vector Machine (OCSVM), Kernel Density Estimation (KDE) and Local Outlier Factor (LOF). The experimental results show increases in detection rate and overall accuracy in comparison to the individuals on several public network anomaly detection datasets.