RADON: Robust Autoencoder for Unsupervised Anomaly Detection

Anomaly detection is a critical element in the design of secure and reliable networks. Networks are vulnerable to diverse anomalies, including malicious attacks, traffic congestion, operational problems, and hardware failures. In addition, novel unknown anomalies are constantly emerging, which challenges existing knowledge-based anomaly detectors. In this paper, we propose RADON, a robust algorithm for unsupervised anomaly detection, which does not require anomaly signatures or any labeled training data. RADON consists in a novel robust training strategy applied to an autoencoder. First, a filtering rule is applied on the reconstruction scores of traffic metadata to identify potential anomalies contaminating the training data. Then, RADON simultaneously learns to minimize the reconstruction scores of nominal instances, and to maximize that of the filtered anomalies. Finally, the trained model is leveraged to detect anomalous observations. Extensive experiments on the MNIST, NSL-KDD and MedBIoT benchmark datasets illustrate the effectiveness of our approach for anomaly detection, both in image and network traffic analyses.