A Lightweight Graph-Based Network Anomaly Detection and Explainable Security Monitoring System

Network Monitoring Tools generates lots of technical information about networks which is difficult for people at home or in a small office environment to understand and use effectively. The article describes an easy-to-use tool for detecting unusual activity on networks by explaining alerts simply to non-technical people without any prior knowledge of machine learning models during runtime. Packet capture is done by this system which divides it into windows of size 100 then creates an undirected weighted graph on those IP addresses within each window. The test was done by simulating a capture of 9,534 packets (96 windows) with background traffic and six injected attack patterns. Five out of six were detected by this system as a port scan from each side; also there was an SSH password guess attempt from both sides; a network sweep; and a botnet beaconing behavior. Mislabeled a distributed flood as an attack on brute force attacks while missing out on detecting a single destination data transfer. Transparency based detection is effective for detecting all kinds of attacks through traceable decision making whereas a static threshold per window fails to detect those which are distributed over multiple sources/windows.