基于自编码神经网络的可疑ARP活动检测与聚类
Suspicious ARP Activity Detection and Clustering Based on Autoencoder Neural Networks
摘要：
互联网上智能设备的数量迅速增加，需要一个有效的检查系统来保护我们的网络免受地址解析协议（ARP）探测等可疑活动的影响。在本研究中，我们根据封包的数量与度来分析区域网路上ARP流量的序列资料。此外，一个动态阈值被用来检测潜在的可疑活动，这是进一步转换为特征向量训练的无监督自动编码器神经网络。然后，我们利用K-means聚类将自动编码器中提取的可疑活动的潜在特征分离为各种模式。此外，为了评估性能，我们收集并采用了来自五个不同局域网的真实网络流量数据集。最后，我们成功地检测到可疑的ARP模式不同的规模，寿命和规律性的局域网上。
英文摘要：
The rapidly increasing number of smart devices on the Internet necessitates an efficient inspection system for safeguarding our networks from suspicious activities such as Address Resolution Protocol (ARP) probes. In this research, we analyze sequence data of ARP traffic on LAN based on the numerical count and degree of its packets. Moreover, a dynamic threshold is employed to detect underlying suspicious activities, which are further converted into feature vectors to train an unsupervised autoencoder neural network. Then, we leverage K-means clustering to separate the extracted latent features of suspicious activities from the autoencoder into various patterns. Besides, to evaluate the performance, we collect and adopt a real-world network traffic dataset from five different LANs. At last, we successfully detect suspicious ARP patterns varying in scale, lifespan, and regularity on the LANs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
