Pith. sign in

REVIEW 4 major objections 5 minor 57 references

Anomaly detection in network flows using unsupervised online machine learning

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read An unsupervised online one-class support-vector machine, preprocessed with an incrementally updated scaler, detects anomalous netflow records with about 98% accuracy, near-perfect recall, and less than 0.033 ms of processing per flow; the p

desk verdict Reported accuracy and recall are test-set-selected numbers; the pipeline is clean and reproducible, but the evaluation needs a held-out split. read the letter →

arxiv 2509.01375 v1 pith:NTLLLSSW submitted 2025-09-01 cs.CR cs.AI

Alberto Miguel-Diez , Adrián Campazas-Vega , Ángel Manuel Guerrero-Higueras , Claudia Álvarez-Aparicio , Vicente Matellán-Olivera This is my paper
classification cs.CRcs.AI
keywords unsupervisedlearningonlineanomalydetectionnetworkflowsnetflownoveltyOne-ClassSVMstreamingpreprocessing
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Network traffic grows too fast and changes too quickly for signature-based or batch-trained detectors, and labeled attack data is scarce. This paper tries to establish that a fully unsupervised, fully online pipeline—one that learns from each flow as it arrives and discards it—can detect malicious netflow records in real time. It reports that a one-class support-vector machine, fed incrementally scaled features and a quantile-based alarm rule, achieves about 98% accuracy, near-perfect recall, and a false-positive rate below 3.1% on two versions of a standard netflow benchmark, with per-flow processing around 0.03 ms. The intended takeaway is that real-time anomaly detection on standard flow records does not need labels, batch storage, or periodic retraining.

What carries the argument

The load-bearing object is the online one-class SVM: a support-vector machine that fits a boundary around normal data rather than separating labeled classes. It is paired with an incrementally updated max-absolute-value scaler that normalizes each feature by the largest absolute value seen so far, and with a quantile-based filter that flags a flow as anomalous when its score rises above a tunable percentile of the running score distribution. The pipeline also continues to update the model on every flow it deems benign, so the decision boundary tracks legitimate traffic drift without operator intervention or batch retraining.

What would settle it

A strictly causal replay of the two netflow benchmarks—where the scaler and the model are updated only with flows that precede the current one, keeping the per-dataset hyperparameters fixed—would produce a new accuracy/recall/false-positive triple. If those figures stay near 98% accuracy and 100% recall, the leakage is immaterial; if they fall, the claimed real-time feasibility needs qualification.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that a fully streaming pipeline—an incremental max-absolute-value scaler feeding a one-class support-vector machine, with a quantile-based decision rule and self-training on flows the model judges benign—can learn normal network behavior from unlabeled netflow and flag attacks as they arrive. Evaluated on two versions of a public netflow benchmark (about 1.6 and 2.4 million flows), the model reports accuracy of 0.9853 and 0.9848, precision of 0.9745 and 0.9706, recall of 0.9967 and 1.0, and false-positive rates of 0.0261 and 0.0304, with per-flow processing time under 0.033 ms. The authors take these numbers as evidence that unsupervised onl

Load-bearing premise

The headline numbers assume the feature scaler's running maximum can be influenced by the very attack flows the model is later asked to classify; in a live stream, those flows have not happened yet, so the scaling and the scores would differ.

Editorial extensions

If this is right

  • A network operator could run the model on commodity hardware at rates typical of flow export, since per-flow processing stays below 0.033 ms.
  • Attack categories absent from the warm-up phase are still caught, because the boundary is drawn around normality rather than around known attack signatures.
  • The system adapts to gradual changes in legitimate traffic, since the model keeps learning from flows it classifies as benign.
  • A false-positive rate below 3.1% means at most about 31 benign flows in 1,000 trigger an alarm, a workload that security teams could plausibly handle.
  • Because labels are used only for evaluation, the same pipeline transfers to a new network without collecting or labeling attack data there.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Replaying the same benchmarks with a strictly causal scaler—updated only on flows that arrived earlier—would isolate how much of the reported accuracy depends on the scaler's having seen attack flows during preprocessing.
  • A deployment-oriented evaluation on the original imbalanced class ratio, rather than a balanced 50/50 test set, would show whether 98% accuracy still holds in operational conditions.
  • The quantile threshold is currently tuned per dataset; an open question the paper leaves is how to set or adapt this threshold online without labels.
  • Combining this online detector with a small, periodically refreshed set of labeled flows could cut the 3% false-positive rate while preserving the high recall.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The manuscript proposes an unsupervised online anomaly-detection model for NetFlow traffic. It uses a River-library One-Class SVM, an incremental scaler, and a quantile-based decision threshold. The data are divided into a 1,000-flow scaler warm-up set, a 100,000-flow benign training warm-up, and a balanced test set containing all attack flows plus an equal number of benign flows. Hyperparameters (q, nu, eta, scaler, feature subset, warm-up sizes) are tuned with a custom script, and the final configuration is evaluated over 12 shuffled runs on NF-UNSW-NB15 and NF-UNSW-NB15-v2. The paper reports accuracy around 0.985, FPR around 0.026-0.030, recall up to 1.0, and average per-flow processing below 0.033 ms, concluding that the method is feasible for real-time deployment.

Significance. If the reported results were obtained under a proper evaluation protocol, the paper would make a useful contribution: it tests an online, unsupervised, flow-based OCSVM on two recent benchmark datasets, provides public code, measures per-flow latency, and uses multiple runs. However, the current evaluation protocol selects the model and threshold on the same test examples used for the final metrics, and the preprocessing scaler is updated on test flows before evaluation. The headline figures are therefore not reliable estimates of deployment performance. The central empirical claim is plausible but currently unsupported; a cleaned-up evaluation with a separated validation set and strictly causal streaming could substantiate it.

major comments (4)
  1. [Section 4.2, Tables 5-6] The custom hyperparameter script optimizes nu, eta, the scaler, the feature subset, the warm-up sizes, and the quantile threshold q by running the full pipeline and evaluating on the same test set later reported in Table 4. No separate validation split or nested resampling is described. Since q directly fixes the anomaly threshold in the score distribution, selecting q with test labels fits the decision boundary to the evaluation set; the reported accuracy/recall/FPR are selected maxima, not unbiased estimates. Report performance on a held-out test set that is never used for configuration selection, with the selected configuration frozen.
  2. [Algorithm 1, lines 17-20] The scaler is updated on X_train ∪ X_test before transformation. Thus the max-absolute statistics used to scale evaluation flows incorporate information from test flows, including attacks, which would not be available at prediction time in deployment. Even if X_train is processed before X_test, scanning the test set to update the scaler at all is a causal leak. Update the scaler only on flows observed before the current prediction, and transform each flow before updating the scaler with it.
  3. [Algorithm 2, lines 13-15] The model is trained on every test flow that is not classified as anomalous. If a true attack is misclassified as benign, the OCSVM is updated on an attack sample, contaminating the normal model. This online self-training loop is a realistic hazard and is not analyzed; the reported recall=1.0 for v2 means no such contamination occurred in that run, but the method should be evaluated for robustness to initial false negatives.
  4. [Section 5, Figures 2-3] The accuracy-evolution plots compare runs under the same test set and after threshold selection. They do not demonstrate stability on unseen data. Report a time-ordered evaluation with the threshold fixed before seeing any test labels, and include confidence intervals for the metrics.
minor comments (5)
  1. [Section 4.1, Eq. (3)] The accuracy formula is misprinted: the denominator should be TP+TN+FP+FN, not TP+TN+FP+TN.
  2. [Section 3.3 and 4.2] The feature subset selection is described only as 'after several analyses.' Please specify the exact feature set and whether its choice was part of the test-set-based optimization.
  3. [Tables 5-6] Provide the search ranges and exact optimization objective used by the custom script, and state how the 12 runs were aggregated for configuration selection.
  4. [Section 3.4] The learning-rate scheduler parameter p is said to use the River default; state the actual value used.
  5. [Section 3.3] The balanced test set changes the operating point relative to real traffic. If the goal is deployment, also report precision-recall behavior or AUC at the natural imbalance, or discuss how the threshold should be adapted.

Circularity Check

3 steps flagged · score 6.0 of 10

Reported metrics are selected on the test set: Section 4.2 tunes q, ν, η, the scaler, and the feature set on the same evaluation set used for Table 4, so the headline accuracy/FPR/recall are fit results, not independent online predictions.

  1. fitted input called prediction [Section 4.2 (Hyper-parameter Optimization) and Section 5, Table 4]
    "In this work, a custom script was developed to perform hyperparameter optimization of the model, following the workflow detailed in Section 3.3. The script allows adjusting the values of the model parameters ν and η. It also enables testing different scaling algorithms, such as MaxAbsScaler, MinMaxScaler, Normalizer, RobustScaler, and StandardScaler. In addition, it provides an easy way to configure the number of flows used in the warm-up phase, the features employed in the analysis, and the handling of IP addresses."

    Section 3.3 creates a single balanced evaluation set (X_test) and Algorithm 2 evaluates on that set. The optimization script selects ν, η, the scaler, the feature subset, the warm-up size, and IP handling by running this same workflow and computing the Section 4.1 metrics; no separate validation split or nested hold-out is described. Table 4 then reports metrics 'after the hyperparameter optimization process' on that same evaluation set. Thus the reported accuracy/FPR/recall are the result of selecting the configuration using the test labels, not an estimate for a fixed online model on unseen flows.

  2. fitted input called prediction [Section 3.4 (Algorithms) and Tables 5-6]
    "This filter takes as a parameter q, which represents the quantile level above which a score is classified as anomalous, and this parameter was tuned during hyperparameter optimization."

    q is the decision threshold of the detector. Tuning q against the same balanced test set used for Table 4 directly fits the decision boundary to the test labels. Tables 5 and 6 then list q=0.99 and q=0.95 as the 'best' configurations, and Section 5 reports the resulting FPR (2.61%/3.04%) and recall (99.67%/100%) on that exact test set. The reported FPR and recall are therefore conditional on a threshold chosen to perform well on those specific flows, so they are not out-of-sample predictions.

1 more flagged steps
  1. other [Algorithm 1, lines 17-20 (Flow Preprocessing)]
    "foreach flow f in X_train ∪ X_test do: Update scaler S with f; Transform flow f using S"

    The MaxAbsScaler's running maximum M(t) is updated on the union of training and test flows before transformation. As written, this means the scaled features on which detection is evaluated can contain information from test flows, including flows that would arrive later in a real stream. The reported accuracy is therefore not computed from features that a strictly online deployment would produce; the scaler is fitted in part on the evaluation set. This is test-set leakage in preprocessing rather than a definitional equivalence, but it reinforces the same conclusion that the headline numbers depend on evaluation-set information.

full rationale

The claimed result is an empirical evaluation, not a mathematical derivation, so the circularity here is not definitional: OCSVM scores, the quantile filter, and the reported accuracy are not defined in terms of one another, and there is no load-bearing self-citation chain or imported uniqueness theorem. However, the reported numbers are not honest out-of-sample estimates. Section 4.2 describes a custom script that tunes ν, η, the scaler, the feature set, the warm-up size, and IP handling by running the full Section 3.3 workflow, whose output is the balanced test set used for Table 4. Section 3.4 states that the quantile threshold q—the decision boundary—was also tuned during this optimization. No separate validation split or nested hold-out is described. Table 4 then reports metrics 'after the hyperparameter optimization process' on that same evaluation set. Consequently, accuracy >98%, FPR <3.1%, and recall 100% are post-selection metrics: they describe the best configuration on the test set, not the expected performance of a fixed online model on unseen traffic. Algorithm 1 adds a second, related leakage by updating the MaxAbsScaler on X_train ∪ X_test, so test flows can contribute to the running maximum used to transform test flows. Neither issue is a definitional self-derivation, but both make the headline 'prediction' depend on the evaluation data, so a partial circularity score of 6 is warranted.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The central empirical claim rests on several fitted choices (hyperparameters, scaler, features, warm-up sizes) and on unstated assumptions about the correctness of the dataset labels and the fairness of the balanced test set. No new physical or conceptual entities are introduced.

free parameters (7)
  • nu (anomaly rate) = 0.05 (NF-UNSW-NB15), 0.1 (v2)
    Tuned per dataset using a custom optimization script on the evaluation set.
  • eta (learning rate) = 0.1 (NF-UNSW-NB15), 0.3 (v2)
    Selected as part of the same hyperparameter optimization.
  • q (quantile threshold) = 0.99 (NF-UNSW-NB15), 0.95 (v2)
    Chosen to maximize performance on the test data.
  • Scaler selection = MaxAbsScaler
    Chosen from five candidate scalers based on test performance.
  • Feature subset = source IP, dest IP, ports, protocol, in/out bytes, duration
    Selected after 'several analyses' on the dataset, i.e., using the data to choose features.
  • Scaler warm-up size = 1,000 flows
    Described as hyperparameterized; this value provided the best results.
  • Training warm-up size = 100,000 flows
    Chosen as the smallest amount yielding satisfactory results.
assumptions (4)
  • domain assumption The River online OCSVM implementation correctly approximates a one-class decision boundary.
    The paper relies on the library without deriving or verifying the algorithm's behavior.
  • domain assumption The NF-UNSW-NB15 and v2 labels are accurate ground truth.
    Labels are used for evaluation without independent verification.
  • domain assumption The quantile filter computes its threshold from the observed score distribution as described.
    The mechanism is not precisely specified, and the reported results depend on its behavior.
  • domain assumption A balanced test set is an appropriate measure of real-world performance.
    The balanced evaluation set is used to avoid accuracy bias, but it does not reflect real traffic class proportions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Anomaly detection in network flows using unsupervised online machine learning." pith.science (2026). https://pith.science/paper/NTLLLSSW

@misc{pith2026250901375,
  author       = {Pith},
  title        = {Pith review of: Anomaly detection in network flows using unsupervised online machine learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NTLLLSSW}},
  note         = {Machine review of arXiv:2509.01375}
}
read the original abstract

Nowadays, the volume of network traffic continues to grow, along with the frequency and sophistication of attacks. This scenario highlights the need for solutions capable of continuously adapting, since network behavior is dynamic and changes over time. This work presents an anomaly detection model for network flows using unsupervised machine learning with online learning capabilities. This approach allows the system to dynamically learn the normal behavior of the network and detect deviations without requiring labeled data, which is particularly useful in real-world environments where traffic is constantly changing and labeled data is scarce. The model was implemented using the River library with a One-Class SVM and evaluated on the NF-UNSW-NB15 dataset and its extended version v2, which contain network flows labeled with different attack categories. The results show an accuracy above 98%, a false positive rate below 3.1%, and a recall of 100% in the most advanced version of the dataset. In addition, the low processing time per flow (<0.033 ms) demonstrates the feasibility of the approach for real-time applications.

Figures

Figures reproduced from arXiv: 2509.01375 by the authors.

Figure 1
Figure 1. Four-stage preprocessing pipeline applied to network flows before feeding the model [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Evolution of accuracy throughout the evaluation phase on the NF-UNSW-NB15 dataset (12 runs) • Average processing time per flow: 0.0285 ms. A slight increase in total evaluation time is observed compared to the first dataset. However, this is expected due to the higher number of flows processed, 45,294 more in the evaluation phase. Despite this increase, the average processing time per flow remains below 0.033 ms, we… view at source ↗
Figure 3
Figure 3. Evolution of accuracy throughout the evaluation phase on the NF-UNSW-NB15-v2 dataset (12 runs) robust to large-scale variations and preserves sparsity, this configuration enables stable and efficient online learning. The MaxAbsScaler was selected as the normalization method due to its suitability for streaming data scenarios such as network flow analysis. This scaler transforms each feature by dividing its value by … view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

57 extracted references · 52 canonical work pages

  1. [1]

    Introduction: From Batch to Online Machine Learning, in: Bartz, E., Bartz-Beielstein, T

    Bartz-Beielstein, T., 2024. Introduction: From Batch to Online Machine Learning, in: Bartz, E., Bartz-Beielstein, T. (Eds.), Online Machine Learning. Springer Nature Singapore, Singapore, pp. 1–

    work page 2024

  2. [2]

    AnExperimentalComparisonof BatchandOnlineMachineLearningAlgorithms,in:Bartz,E.,Bartz- Beielstein, T

    Bartz-Beielstein,T.,Hans,L.,2024. AnExperimentalComparisonof BatchandOnlineMachineLearningAlgorithms,in:Bartz,E.,Bartz- Beielstein, T. (Eds.), Online Machine Learning. Springer Nature Singapore, Singapore, pp. 105–124. URL: https://link.springer. com/10.1007/978-981-99-7007-0_9 , doi:10.1007/978-981-99-7007-0_9 . series Title: Machine Learning: Foundation...

    work page doi:10.1007/978-981-99-7007-0_9 2024

  3. [3]

    The uci kdd archive of large data sets for data mining research and experimenta- tion

    Bay, S.D., Kibler, D., Pazzani, M.J., Smyth, P., 2000. The uci kdd archive of large data sets for data mining research and experimenta- tion. SIGKDD Explor. Newsl. 2, 81–85. URL:https://doi.org/10. 1145/380995.381030, doi:10.1145/380995.381030

    work page arXiv 2000

  4. [4]

    Belacel, N., Richard, R., Xu, Z.M., 2022. An LSTM Encoder- Decoder Approach for Unsupervised Online Anomaly Detection in MachineLearningPackagesforStreamingData,in:2022IEEEInter- nationalConferenceonBigData(BigData),IEEE,Osaka,Japan.pp. 3348–3357. URL: https://ieeexplore.ieee.org/document/10020872/, doi:10.1109/BigData55660.2022.10020872

    work page arXiv 2022

  5. [5]

    CiscoSystemsNetFlowServicesExportVersion

    BenoîtClaise,2004. CiscoSystemsNetFlowServicesExportVersion

    work page 2004

  6. [6]

    Campazas-Vega, A., Crespo-Martínez, I.S., Guerrero-Higueras, Á.M., Álvarez-Aparicio, C., Matellán, V., Fernández-Llamas, C.,

    work page

  7. [7]

    URL: https://blog.checkpoint.com/research/ a-closer-look-at-q3-2024-75-surge-in-cyber-attacks-worldwide/

    Check Point Blog, 2024. URL: https://blog.checkpoint.com/research/ a-closer-look-at-q3-2024-75-surge-in-cyber-attacks-worldwide/

    work page 2024

  8. [8]

    Chen, W., Luo, X., Zincir-Heywood, A.N., 2017. Exploring a service-based normal behaviour profiling system for botnet detec- tion, in: 2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM), IEEE, Lisbon, Portugal. pp. 947–952. URL: http://ieeexplore.ieee.org/document/7987417/, doi:10.23919/ INM.2017.7987417

    work page arXiv 2017

Show all 57 references
  1. [9]

    Internet Engineering Task Force (IETF)

    Technical Report RFC 3954. Internet Engineering Task Force (IETF). URL: https://datatracker.ietf.org/doc/html/rfc3954

  2. [10]

    Average number devices and connections per person worldwide in 2018 and 2023 [graph]

    Cisco Systems, 2020. Average number devices and connections per person worldwide in 2018 and 2023 [graph]. https://www.statista.com/statistics/1190270/ number-of-devices-and-connections-per-person-worldwide/ . Accessed: 2025-07-08

    2020

  3. [11]

    series Title: Machine Learning: Foundations, Methodologies, and Applications

    URL: https://link.springer.com/10.1007/978-981-99-7007-0_ 1, doi:10.1007/978-981-99-7007-0_1 . series Title: Machine Learning: Foundations, Methodologies, and Applications

    doi

  4. [12]

    Cho, K., Mitsuya, K., Kato, A., 2000. Traffic data repository at the WIDEproject,in:ProceedingsoftheAnnualConferenceonUSENIX : Preprint submitted to Elsevier Page 11 of 13 Anomaly detection in network flows using unsupervised online machine learning Annual Technical Conference...

    2000

  5. [13]

    The choice of scaling technique matters for classification performance

    de Amorim, L.B., Cavalcanti, G.D., Cruz, R.M., 2023. The choice of scaling technique matters for classification performance. Applied Soft Computing 133, 109924. URL: https://www.sciencedirect. com/science/article/pii/S1568494622009735,doi: https://doi.org/10. 1016/j.asoc.2022.109924

    2023

  6. [14]

    Cisco Systems NetFlow Services Export Version 9

    Claise, B., 2004. Cisco Systems NetFlow Services Export Version 9. RFC 3954. URL:https://www.rfc-editor.org/info/rfc3954, doi:10. 17487/RFC3954

    2004

  7. [15]

    Digitalaroundtheworld

    Datareportal,. Digitalaroundtheworld. URL: https://datareportal. com/global-digital-overview

  8. [16]

    An empirical comparison of botnet detection methods

    García, S., Grill, M., Stiborek, J., Zunino, A., 2014a. An empirical comparison of botnet detection methods. Computers & Security 45, 100–123. URL: https://linkinghub.elsevier.com/retrieve/pii/ S0167404814000923, doi:10.1016/j.cose.2014.05.011

    2014 doi

  9. [17]

    Online and Scal- able Unsupervised Network Anomaly Detection Method

    Dromard, J., Roudiere, G., Owezarski, P., 2017. Online and Scal- able Unsupervised Network Anomaly Detection Method. IEEE Transactions on Network and Service Management 14, 34–47. URL: http://ieeexplore.ieee.org/document/7740019/, doi: 10.1109/ TNSM.2016.2627340

    2017

  10. [18]

    IoT-23: A labeled dataset with malicious and benign IoT network traffic

    Garcia, S., Parmisano, A., Erquiaga, M.J., 2020. IoT-23: A labeled dataset with malicious and benign IoT network traffic. URL:https: //zenodo.org/record/4743746, doi:10.5281/ZENODO.4743746

    2020

  11. [19]

    Incremental learning algorithms and applications, in: European Symposium on Artificial Neural Net- works (ESANN), Bruges, Belgium

    Gepperth, A., Hammer, B., 2016. Incremental learning algorithms and applications, in: European Symposium on Artificial Neural Net- works (ESANN), Bruges, Belgium. URL: https://hal.science/ hal-01418129

    2016

  12. [20]

    An empirical comparison of botnet detection methods

    García, S., Grill, M., Stiborek, J., Zunino, A., 2014b. An empirical comparison of botnet detection methods. Computers & Security 45,100–123. URL: https://www.sciencedirect.com/science/article/ pii/S0167404814000923,doi: https://doi.org/10.1016/j.cose.2014.05. 011

    2014 doi

  13. [21]

    Anomaly detection based on machine learning dimensionality reduction using pca and classification using svm

    George, A., 2012. Anomaly detection based on machine learning dimensionality reduction using pca and classification using svm. InternationalJournalofComputerApplications47,5–8. doi: 10.5120/ 7470-0475

    2012

  14. [22]

    Habibi Lashkari, A., Draper Gil, G., Mamun, M.S.I., Ghorbani, A.A., 2017. Characterization of Tor Traffic using Time based Features:, in: Proceedings of the 3rd International Conference on Information Systems Security and Privacy, SCITEPRESS - Sci- ence and Technology Publicat...

    2017 doi

  15. [23]

    An Evaluation Framework for Intrusion Detection Dataset, in: 2016 In- ternationalConferenceonInformationScienceandSecurity(ICISS), IEEE,Pattaya,Thailand.pp.1–6

    Gharib,A.,Sharafaldin,I.,Lashkari,A.H.,Ghorbani,A.A.,2016. An Evaluation Framework for Intrusion Detection Dataset, in: 2016 In- ternationalConferenceonInformationScienceandSecurity(ICISS), IEEE,Pattaya,Thailand.pp.1–6. URL: http://ieeexplore.ieee.org/ document/7885840/, doi:1...

    2016

  16. [24]

    LocalIntrinsicDimensionality of IoT Networks for Unsupervised Intrusion Detection, in: Sural, S., Lu, H

    Gorbett,M.,Shirazi,H.,Ray,I.,2022. LocalIntrinsicDimensionality of IoT Networks for Unsupervised Intrusion Detection, in: Sural, S., Lu, H. (Eds.), Data and Applications Security and Privacy XXXVI. Springer International Publishing, Cham. volume 13383, pp. 143–

    2022

  17. [25]

    Kabir, M.A., Luo, X., 2020. Unsupervised Learning for Network FlowBasedAnomalyDetectionintheEraofDeepLearning,in:2020 IEEESixthInternationalConferenceonBigDataComputingService andApplications(BigDataService),IEEE,Oxford,UnitedKingdom. pp. 165–168. URL:https://ieeexplore.ieee.o...

    2020

  18. [26]

    1999 DARPA Intrusion Detection Evaluation Dataset

    Lincoln Laboratory, . 1999 DARPA Intrusion Detection Evaluation Dataset. URL: https://www.ll.mit.edu/r-d/datasets/ 1999-darpa-intrusion-detection-evaluation-dataset

    1999

  19. [27]

    Networkanomalydetectionusingdeepautoencoderandparallelarti- ficial bee colony algorithm-trained neural network

    Hacılar, H., Dedeturk, B.K., Bakir-Gungor, B., Gungor, V.C., 2024. Networkanomalydetectionusingdeepautoencoderandparallelarti- ficial bee colony algorithm-trained neural network. PeerJ Computer Science 10, e2333. URL:http://dx.doi.org/10.7717/peerj-cs.2333, doi:10.7717/peerj-cs.2333

    2024 doi

  20. [28]

    AI-Powered Recognition of the Language of Fraud: Combining Topic Modeling, Stylometric and Sentiment Min- ing Approaches for Deceptive Opinion Spam Detection

    Jakupov, A., 2023. AI-Powered Recognition of the Language of Fraud: Combining Topic Modeling, Stylometric and Sentiment Min- ing Approaches for Deceptive Opinion Spam Detection. Phd thesis. CY Cergy Paris Université. France. Doctoral School ED SI, Major: STIC (Sciences et Tech...

    2023

  21. [29]

    River: machine learning for streaming data in Python

    Montiel, J., Halford, M., Mastelini, S.M., Bolmier, G., Sourty, R., Vaysse, R., Zouitine, A., Gomes, H.M., Read, J., Abdessalem, T., others, 2021. River: machine learning for streaming data in Python

    2021

  22. [30]

    Moustafa, N., Slay, J., 2015. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 net- work data set), in: 2015 Military Communications and Information Systems Conference (MilCIS), IEEE, Canberra, Australia. pp. 1– 6.URL: http://ieeexplore.ie...

    2015

  23. [31]

    URL:https://arxiv.org/abs/2503.08293, doi:10.48550/ARXIV.2503.08293

    Miguel-Diez,A.,Campazas-Vega,A.,ÁlvarezAparicio,C.,Esteban- Costales,G.,Guerrero-Higueras,A.M.,2025a.Asystematicliterature review of unsupervised learning algorithms for anomalous traffic detection based on flows. URL:https://arxiv.org/abs/2503.08293, doi:10.48550/ARXIV.2503.0...

    doi

  24. [32]

    Github repository

    Miguel-Diez, A., Campazas-Vega, A., Guerrero-Higueras, A.M., Álvarez Aparicio, C., Matellán-Olivera, V., 2025b. Github repository. URL: https://github.com/amigueldiez/ anomaly-detection-online-learning-paper

  25. [33]

    Boostedenml: Efficient technique for detecting cyberattacks in iot systems using boosted ensemble machine learning

    Okey, O.D., Maidin, S.S., Adasme, P., Lopes Rosa, R., Saadi, M., Carrillo Melgarejo, D., Zegarra Rodríguez, D., 2022. Boostedenml: Efficient technique for detecting cyberattacks in iot systems using boosted ensemble machine learning. Sensors 22, 7409. URL:http: //dx.doi.org/10...

    2022 doi

  26. [34]

    InMonCorporation’ssFlow: A Method for Monitoring Traffic in Switched and Routed Networks

    Panchen,S.,McKee,N.,Phaal,P.,2001. InMonCorporation’ssFlow: A Method for Monitoring Traffic in Switched and Routed Networks. RFC 3176. URL:https://www.rfc-editor.org/info/rfc3176, doi:10. 17487/RFC3176

    2001

  27. [35]

    An Online Offline Framework for Anomaly Scoring and Detecting New Traffic in Network Streams

    Odiathevar, M., Seah, W.K., Frean, M., Valera, A., 2022. An Online Offline Framework for Anomaly Scoring and Detecting New Traffic in Network Streams. IEEE Transactions on Knowledge and Data Engineering 34, 5166–5181. URL: https://ieeexplore.ieee.org/ document/9319564/, doi:10...

    2022

  28. [36]

    A Hybrid Online Offline System for Network Anomaly Detection, in: 2019 28th In- ternational Conference on Computer Communication and Networks (ICCCN),IEEE,Valencia,Spain.pp.1–9

    Odiathevar, M., Seah, W.K.G., Frean, M., 2019. A Hybrid Online Offline System for Network Anomaly Detection, in: 2019 28th In- ternational Conference on Computer Communication and Networks (ICCCN),IEEE,Valencia,Spain.pp.1–9. URL: https://ieeexplore. ieee.org/document/8847011/,...

    2019

  29. [37]

    Towards highperformancepacketprocessingfor5g,in:2015IEEEConference on Network Function Virtualization and Software Defined Network (NFV-SDN), pp

    Pinczel,B.,Géhberger,D.,Turányi,Z.,Formanek,B.,2015. Towards highperformancepacketprocessingfor5g,in:2015IEEEConference on Network Function Virtualization and Software Defined Network (NFV-SDN), pp. 67–73. doi:10.1109/NFV-SDN.2015.7387408. : Preprint submitted to Elsevier Page...

    2015

  30. [38]

    The im- pact of feature scaling in machine learning: Effects on regression and classification tasks

    Pinheiro, J.M.H., de Oliveira, S.V.B., Silva, T.H.S., Saraiva, P.A.R., de Souza, E.F., Ambrosio, L.A., Becker, M., 2025. The im- pact of feature scaling in machine learning: Effects on regression and classification tasks. URL: https://arxiv.org/abs/2506.08274, arXiv:2506.08274

    2025

  31. [39]

    Scikit-learn: Machine Learning in Python

    Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Prettenhofer, P., Weiss, R., Dubourg, V., Vanderplas, J., Passos, A., Cournapeau, D., Brucher, M., Perrot, M., Duchesnay, E., 2011. Scikit-learn: Machine Learning in Python. Journal o...

    2011

  32. [40]

    A review of novelty detection

    Pimentel, M.A., Clifton, D.A., Clifton, L., Tarassenko, L., 2014. A review of novelty detection. Signal Processing 99, 215–

    2014

  33. [41]

    Net- Flow Datasets for Machine Learning-Based Network Intrusion De- tection Systems, in: Deze, Z., Huang, H., Hou, R., Rho, S., Chilamkurti, N

    Sarhan, M., Layeghy, S., Moustafa, N., Portmann, M., 2021. Net- Flow Datasets for Machine Learning-Based Network Intrusion De- tection Systems, in: Deze, Z., Huang, H., Hou, R., Rho, S., Chilamkurti, N. (Eds.), Big Data Technologies and Applications. Springer International Pub...

    2021

  34. [42]

    Towards a Standard Feature Set for Network Intrusion Detection System Datasets

    Sarhan, M., Layeghy, S., Portmann, M., 2022. Towards a Standard Feature Set for Network Intrusion Detection System Datasets. Mobile Networks and Applications 27, 357–370. URL: https://link.springer.com/10.1007/s11036-021-01843-0, doi:10.1007/s11036-021-01843-0

    2022 doi

  35. [43]

    Schueller, Q., Basu, K., Younas, M., Patel, M., Ball, F., 2018. A Hierarchical Intrusion Detection System using Support Vector Ma- chine for SDN Network in Cloud Data Center, in: 2018 28th Inter- national Telecommunication Networks and Applications Conference (ITNAC), IEEE, Sy...

    2018

  36. [44]

    2024 Global Threat Analysis Report: Executive Summary

    Radware, 2024. 2024 Global Threat Analysis Report: Executive Summary. Technical Report. Radware. URL: https: //www.cisco.com/c/dam/m/en_in/events/security-conclave-2024/ radware-threat-report-summary-2024.pdf . analysis of the most significant cybersecurity events and trends of 2023

    2024

  37. [45]

    A compara- tive assessment of machine learning algorithms in the iot-based network intrusion detection systems

    Samantaray, M., Barik, R.C., Biswal, A.K., 2024. A compara- tive assessment of machine learning algorithms in the iot-based network intrusion detection systems. Decision Analytics Journal 11, 100478. URL: https://www.sciencedirect.com/science/article/ pii/S2772662224000821, do...

    2024 doi

  38. [46]

    Adetailed analysis of the KDD CUP 99 data set, in: 2009 IEEE Symposium onComputationalIntelligenceforSecurityandDefenseApplications, IEEE, Ottawa, ON, Canada

    Tavallaee,M.,Bagheri,E.,Lu,W.,Ghorbani,A.A.,2009. Adetailed analysis of the KDD CUP 99 data set, in: 2009 IEEE Symposium onComputationalIntelligenceforSecurityandDefenseApplications, IEEE, Ottawa, ON, Canada. pp. 1–6. URL:http://ieeexplore.ieee. org/document/5356528/, doi:10.1...

    2009

  39. [47]

    Hybrid Machine Learning Traf- fic Flows Analysis for Network Attacks Detection, in: 2022 30th Telecommunications Forum(TELFOR), IEEE, Belgrade,Serbia

    Timcenko, V., Gajin, S., 2022. Hybrid Machine Learning Traf- fic Flows Analysis for Network Attacks Detection, in: 2022 30th Telecommunications Forum(TELFOR), IEEE, Belgrade,Serbia. pp. 1–8. URL: https://ieeexplore.ieee.org/document/9983780/, doi:10. 1109/TELFOR56187.2022.9983780

    2022

  40. [48]

    Unsupervised Machine Learning Techniques for Network Intrusion Detection on Modern Data, in: 2020 4th Cyber Security in Networking Conference (CSNet), IEEE, Lausanne, Switzerland

    Verkerken, M., D’hooge, L., Wauters, T., Volckaert, B., De Turck, F., 2020. Unsupervised Machine Learning Techniques for Network Intrusion Detection on Modern Data, in: 2020 4th Cyber Security in Networking Conference (CSNet), IEEE, Lausanne, Switzerland. pp. 1–8. URL: https:/...

    2020

  41. [49]

    Bot- Mark: Automated botnet detection with hybrid analysis of flow- based and graph-based traffic behaviors

    Wang, W., Shang, Y., He, Y., Li, Y., Liu, J., 2020. Bot- Mark: Automated botnet detection with hybrid analysis of flow- based and graph-based traffic behaviors. Information Sciences 511,284–296.URL: https://linkinghub.elsevier.com/retrieve/pii/ S0020025519308758, doi:10.1016/j...

    2020 doi

  42. [50]

    Acom- parativestudyononlinemachinelearningtechniquesfornetworktraf- fic streams analysis

    Shahraki,A.,Abbasi,M.,Taherkordi,A.,Jurcut,A.D.,2022. Acom- parativestudyononlinemachinelearningtechniquesfornetworktraf- fic streams analysis. Computer Networks 207, 108836. URL:https: //linkinghub.elsevier.com/retrieve/pii/S1389128622000512, doi: 10. 1016/j.comnet.2022.108836

    2022

  43. [51]

    Sharafaldin, I., Habibi Lashkari, A., Ghorbani, A.A., 2018. Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization:, in: Proceedings of the 4th International Confer- ence on Information Systems Security and Privacy, SCITEPRESS - Science and ...

    2018 doi

  44. [56]

    URL: https://arxiv.org/abs/2501.05387, arXiv:2501.05387

    Zeleke,S.N.,Jember,A.F.,Bochicchio,M.,2025.Integratingexplain- able ai for effective malware detection in encrypted network traffic. URL: https://arxiv.org/abs/2501.05387, arXiv:2501.05387

    2025 arXiv

  45. [57]

    Requirements for IP Flow Information Export (IPFIX)

    Zseby, T., Claise, B., Quittek, J., Zander, S., 2004. Requirements for IP Flow Information Export (IPFIX). RFC 3917. URL:https: //www.rfc-editor.org/info/rfc3917, doi:10.17487/RFC3917. : Preprint submitted to Elsevier Page 13 of 13

    2004 doi

  46. [135]

    series Title: Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommu- nications Engineering

    URL: http://link.springer.com/10.1007/978-3-030-72802-1_9 , doi:10.1007/978-3-030-72802-1_9 . series Title: Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommu- nications Engineering

    doi

  47. [161]

    series Title: Lecture Notes in Computer Science

    URL: https://link.springer.com/10.1007/978-3-031-10684-2_ 9, doi:10.1007/978-3-031-10684-2_9 . series Title: Lecture Notes in Computer Science

    doi

  48. [249]

    URL: https://www.sciencedirect.com/science/article/pii/ S016516841300515X, doi: https://doi.org/10.1016/j.sigpro.2013.12. 026

    2013 doi

  49. [2023]

    Malicious traffic detection on sampled network flow data with novelty-detection-based models. Sci. Rep. 13, 15446

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.