Unsupervised network anomaly detection based on abnormality weights and subspace clustering

Most traditional network anomalies and attacks detection systems tend to employ supervised strategies, which require labeled training dataset that is arduous and expensive to obtain and fails to detect unknown attacks jeopardizing the system security and reliability. In this paper we present a new unsupervised approach based on abnormality weights rendering and subspace clustering techniques to detect network anomalies without previously labeled traffic or signatures. In order to examine capability of the proposed approach, we conducted several experiments on both real network traffic and KDD99 dataset. Its performance was compared against previously used network anomaly detection methods. The results show that our approach is better than the other detection techniques.