Information Technologies and Computer Engineering

The growth in the volume and heterogeneity of network traffic complicates the timely detection of attacks, whereas signature-based approaches do not cover new or modified threats. Interpretable and reproducible methods for analysing data flows are needed, and they must be suitable for integration into monitoring systems. The purpose of the study was to develop and implement a monitoring system that separates normal connections from anomalous ones without prior data labelling and provides transparent decision-making criteria. The research methodology was based on the standardisation of network traffic features and the use of the unsupervised k-means clustering algorithm, followed by anomaly detection through deviations from centroids. On a synthetic set of events with a small proportion of violations, the system consistently formed two compact clusters corresponding to typical and atypical behaviour. The centroid of normal traffic was characterised by lower values for the volumes of transmitted and received data and lower connection activity; the centroid of anomalous traffic had substantially higher values across all features. The combined post-clustering rule reduced false positives that arise during legitimate large transfers, for example, backups, while maintaining a high proportion of correctly detected rare events. Comparative experiments demonstrated comparable or higher precision and recall than classical outlier detection approaches, along with a stable millisecond-level processing time for one thousand records. The sensitivity analysis confirmed robustness to the choice of distance threshold and preprocessing parameters. The experimental sample contained 1,000 records, of which 980 corresponded to normal network traffic and 20 corresponded to anomalous events (2%). Clustering formed two clusters, with the smaller cluster grouping 20 records that corresponded to atypical network behaviour. The proposed approach does not require reference labels, scales easily, provides transparent explanations through centroids and distances, is suitable for batch and stream processing, and can serve as a basic component in production anomaly detection pipelines

References