Time-series entropy data clustering for effective anomaly detection

Abstract

In this paper, the focus of the research is on the comprehensive flow-based anomaly detection architecture which is based on the joint use of the entropy calculation and machine learning algorithms, and its enhancement with time-series techniques. The proposed solution is evaluated with the modified CTU-13 dataset, which includes instances of normal, background and botnet traffic. The analysis encompasses a range of unsupervised machine learning algorithms, time-series and entropy threshold analysis with different configuration parameters.