{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,18]],"date-time":"2026-04-18T08:46:14Z","timestamp":1776501974246,"version":"3.51.2"},"reference-count":43,"publisher":"MDPI AG","issue":"6","license":[{"start":{"date-parts":[[2021,6,11]],"date-time":"2021-06-11T00:00:00Z","timestamp":1623369600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>Anomaly-based intrusion detection methods aim to combat the increasing rate of zero-day attacks, however, their success is currently restricted to the detection of high-volume attacks using aggregated traffic features. Recent evaluations show that the current anomaly-based network intrusion detection methods fail to reliably detect remote access attacks. These are smaller in volume and often only stand out when compared to their surroundings. Currently, anomaly methods try to detect access attack events mainly as point anomalies and neglect the context they appear in. We present and examine a contextual bidirectional anomaly model (CBAM) based on deep LSTM-networks that is specifically designed to detect such attacks as contextual network anomalies. The model efficiently learns short-term sequential patterns in network flows as conditional event probabilities. Access attacks frequently break these patterns when exploiting vulnerabilities, and can thus be detected as contextual anomalies. We evaluated CBAM on an assembly of three datasets that provide both representative network access attacks, real-life traffic over a long timespan, and traffic from a real-world red-team attack. We contend that this assembly is closer to a potential deployment environment than current NIDS benchmark datasets. We show that, by building a deep model, we are able to reduce the false positive rate to 0.16% while effectively detecting six out of seven access attacks, which is significantly lower than the operational range of other methods. We further demonstrate that short-term flow structures remain stable over long periods of time, making the CBAM robust against concept drift.<\/jats:p>","DOI":"10.3390\/computers10060079","type":"journal-article","created":{"date-parts":[[2021,6,11]],"date-time":"2021-06-11T12:44:37Z","timestamp":1623415477000},"page":"79","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":20,"title":["CBAM: A Contextual Model for Network Anomaly Detection"],"prefix":"10.3390","volume":"10","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7255-4745","authenticated-orcid":false,"given":"Henry","family":"Clausen","sequence":"first","affiliation":[{"name":"School of Informatics, University of Edinburgh, Edinburgh EH8 9AB, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8837-5496","authenticated-orcid":false,"given":"Gudmund","family":"Grov","sequence":"additional","affiliation":[{"name":"Norwegian Defence Research Establishment (FFI), 2007 Kjeller, Norway"},{"name":"Department of Informatics, University of Oslo, 0373 Oslo, Norway"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6073-9013","authenticated-orcid":false,"given":"David","family":"Aspinall","sequence":"additional","affiliation":[{"name":"School of Informatics, University of Edinburgh, Edinburgh EH8 9AB, UK"},{"name":"The Alan Turing Institute, London NW1 2DB, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2021,6,11]]},"reference":[{"key":"ref_1","unstructured":"Metrick, K., Najafi, P., and Semrau, J. (2021, June 10). Zero-Day Exploitation Increasingly Demonstrates Access to Money, Rather than Skill \u2014 Intelligence for Vulnerability Management; Technical Report, FireEye Technical Report. Available online: https:\/\/www.fireeye.com\/blog\/threat-research\/2020\/04\/zero-day-exploitation-demonstrates-access-to-money-not-skill.html."},{"key":"ref_2","unstructured":"(2021, June 10). M-Trends 2015: A View from the Front Lines, Available online: https:\/\/www2.fireeye.com\/rs\/fireye\/images\/rpt-m-trends-2015.pdf."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"3369","DOI":"10.1109\/COMST.2018.2854724","article-title":"From Intrusion Detection to Attacker Attribution: A Comprehensive Survey of Unsupervised Methods","volume":"20","author":"Nisioti","year":"2018","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Clausen, H., Grov, G., Sabate, M., and Aspinall, D. (2020, January 24\u201326). Better Anomaly Detection for Access Attacks Using Deep Bidirectional LSTMs. Proceedings of the Machine Learning for Networking: Third International Conference, MLN 2020, Paris, France. Revised Selected Papers 3.","DOI":"10.1007\/978-3-030-70866-5_1"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Bontemps, L., Cao, V.L., McDermott, J., and Le-Khac, N.A. (2016). Collective Anomaly Detection Based on Long Short-Term Memory Recurrent Neural Networks. Future Data and Security Engineering, Springer.","DOI":"10.1007\/978-3-319-48057-2_9"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Kim, J., Kim, J., Thu, H.L.T., and Kim, H. (2016, January 15\u201317). Long short term memory recurrent neural network classifier for intrusion detection. Proceedings of the 2016 International Conference on Platform Technology and Service (PlatCon), Jeju, Korea.","DOI":"10.1109\/PlatCon.2016.7456805"},{"key":"ref_7","unstructured":"Radford, B.J., Apolonio, L.M., Trias, A.J., and Simpson, J.A. (2018). Network traffic anomaly detection using recurrent neural networks. arXiv."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Clausen, H., Flood, R., and Aspinall, D. (2021, January 27). Controlling network traffic microstructures for machine-learning model probing. Proceedings of the Manuscript accepted for publication at the Workshop on Traffic Measurements for Cybersecurity, Co-Hosted at IEEE S&P Symposium 2021, San Francisco, CA, USA.","DOI":"10.1007\/978-3-030-90019-9_23"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Rubin-Delanchy, P., Lawson, D.J., Turcotte, M.J., Heard, N., and Adams, N.M. (2014, January 24\u201326). Three statistical approaches to sessionizing network flow data. Proceedings of the 2014 IEEE Joint Intelligence and Security Informatics Conference, The Hague, The Netherlands.","DOI":"10.1109\/JISIC.2014.46"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Chen, W., Grangier, D., and Auli, M. (2015). Strategies for training large vocabulary neural language models. arXiv.","DOI":"10.18653\/v1\/P16-1186"},{"key":"ref_11","unstructured":"Yin, W., Kann, K., Yu, M., and Sch\u00fctze, H. (2017). Comparative study of CNN and RNN for natural language processing. arXiv."},{"key":"ref_12","first-page":"1929","article-title":"Dropout: A simple way to prevent neural networks from overfitting","volume":"15","author":"Srivastava","year":"2014","journal-title":"J. Mach. Learn. Res."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1016\/j.jnca.2015.11.016","article-title":"A survey of network anomaly detection techniques","volume":"60","author":"Ahmed","year":"2016","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2018, January 22\u201324). Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. Proceedings of the ICISSP, Madeira, Portugal.","DOI":"10.5220\/0006639801080116"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Kent, A.D. (2015). Cybersecurity Data Sources for Dynamic Network Research. Dynamic Networks in Cybersecurity, World Scientific.","DOI":"10.1142\/9781786340757_0002"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"411","DOI":"10.1016\/j.cose.2017.11.004","article-title":"UGR \u201816: A new dataset for the evaluation of cyclostationarity-based network IDSs","volume":"73","author":"Camacho","year":"2018","journal-title":"Comput. Secur."},{"key":"ref_17","unstructured":"MIT Lincoln Labs (2021, June 10). 1998 DARPA Intrusion Detection Evaluation Dataset. Available online: https:\/\/www.ll.mit.edu\/r-d\/datasets\/1998-darpa-intrusion-detection-evaluation-dataset."},{"key":"ref_18","unstructured":"University of California, Irvine (2021, June 10). KDD Cup 1999 Dataset. Available online: http:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/kddcup99.html."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"262","DOI":"10.1145\/382912.382923","article-title":"Testing intrusion detection systems: A critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratory","volume":"3","author":"McHugh","year":"2000","journal-title":"ACM Trans. Inf. Syst. Secur. (TISSEC)"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Mahoney, M.V., and Chan, P.K. (2003, January 8\u201310). An analysis of the 1999 DARPA\/Lincoln Laboratory evaluation data for network anomaly detection. Proceedings of the International Workshop on Recent Advances in Intrusion Detection, Pittsburgh, PA, USA.","DOI":"10.1007\/978-3-540-45248-5_13"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A.A. (2009, January 8\u201310). A detailed analysis of the KDD CUP 99 data set. Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, ON, Canada.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Garcia, S., Grill, M., Stiborek, J., and Zunino, A. (2014). An empirical comparison of botnet detection methods. Computers & Security, Elsevier.","DOI":"10.1016\/j.cose.2014.05.011"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_24","unstructured":"Creech, G. (2014). Developing a High-Accuracy Cross Platform Host-Based Intrusion Detection System Capable of Reliably Detecting Zero-Day Attacks. [Ph.D. Thesis, University of New South Wales]."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Damasevicius, R., Venckauskas, A., Grigaliunas, S., Toldinas, J., Morkevicius, N., Aleliunas, T., and Smuikys, P. (2020). LITNET-2020: An annotated real-world network flow dataset for network intrusion detection. Electronics, 9.","DOI":"10.3390\/electronics9050800"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"106187","DOI":"10.1016\/j.dib.2020.106187","article-title":"Bo\u011fazi\u00e7i University distributed denial of service dataset","volume":"32","author":"Erhan","year":"2020","journal-title":"Data Brief"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"453","DOI":"10.6028\/jres.108.040","article-title":"Evaluation of intrusion detection systems","volume":"108","author":"Ulvila","year":"2003","journal-title":"J. Res. Natl. Inst. Stand. Technol."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2808691","article-title":"Evaluating computer intrusion detection systems: A survey of common practices","volume":"48","author":"Milenkoski","year":"2015","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"7550","DOI":"10.1109\/ACCESS.2020.3048198","article-title":"Intrusion Detection of Imbalanced Network Traffic Based on Machine Learning and Deep Learning","volume":"9","author":"Liu","year":"2020","journal-title":"IEEE Access"},{"key":"ref_30","unstructured":"Ye, N. (2000, January 6\u20137). A markov chain model of temporal behavior for anomaly detection. Proceedings of the 2000 IEEE Systems, Man, and Cybernetics Information Assurance and Security Workshop, West Point, NY, USA."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Pellegrino, G., Lin, Q., Hammerschmidt, C., and Verwer, S. (2017, January 8\u201312). Learning behavioral fingerprints from Netflows using Timed Automata. Proceedings of the 2017 IFIP\/IEEE Symposium on Integrated Network and Service Management (IM), Lisbon, Portugal.","DOI":"10.23919\/INM.2017.7987293"},{"key":"ref_32","first-page":"1","article-title":"Towards Intelligible Robust Anomaly Detection by Learning Interpretable Behavioural Models","volume":"32","author":"Grov","year":"2019","journal-title":"NISK J."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Yu, Y., Liu, G., Yan, H., Li, H., and Guan, H. (2018, January 21\u201322). Attention-Based Bi-LSTM Model for Anomalous HTTP Traffic Detection. Proceedings of the 2018 15th International Conference on Service Systems and Service Management (ICSSSM), Hangzhou, China.","DOI":"10.1109\/ICSSSM.2018.8465034"},{"key":"ref_34","unstructured":"Song, Y., Keromytis, A.D., and Swtolfo, S. (2009, January 8\u201311). Spectrogram: A mixture-of-markov-chains model for anomaly detection in web traffic. Proceedings of the Network and Distributed System Security Symposium 2009, San Diego, CA, USA."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Wakui, T., Kondo, T., and Teraoka, F. (2019, January 3\u20135). GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN. Proceedings of the International Conference on Machine Learning for Networking, Paris, France.","DOI":"10.1007\/978-3-030-45778-5_13"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Khan, M.A. (2021). HCRNNIDS: Hybrid Convolutional Recurrent Neural Network-Based Network Intrusion Detection System. Processes, 9.","DOI":"10.3390\/pr9050834"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"107049","DOI":"10.1016\/j.comnet.2019.107049","article-title":"HELAD: A novel network anomaly detection model based on heterogeneous ensemble learning","volume":"169","author":"Zhong","year":"2020","journal-title":"Comput. Netw."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"3469","DOI":"10.1109\/TII.2020.3022432","article-title":"Variational LSTM enhanced anomaly detection for industrial big data","volume":"17","author":"Zhou","year":"2020","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Berman, D.S., Buczak, A.L., Chavis, J.S., and Corbett, C.L. (2019). A survey of deep learning methods for cyber security. Information, 10.","DOI":"10.3390\/info10040122"},{"key":"ref_40","unstructured":"Shen, Y., Mariconti, E., Vervier, P.A., and Stringhini, G. (2018, January 15\u201319). Tiresias: Predicting security events through deep learning. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Du, M., Li, F., Zheng, G., and Srikumar, V. (2017, January 15\u201319). Deeplog: Anomaly detection and diagnosis from system logs through deep learning. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Seoul, Korea.","DOI":"10.1145\/3133956.3134015"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Han, X., Pasquier, T., Bates, A., Mickens, J., and Seltzer, M. (2020). Unicorn: Runtime provenance-based detector for advanced persistent threats. arXiv.","DOI":"10.14722\/ndss.2020.24046"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Sommer, R., and Paxson, V. (2010, January 16\u201319). Outside the Closed World: On Using Machine Learning for Network Intrusion Detection. Proceedings of the 2010 IEEE Symposium on Security and Privacy, Oakland, CA, USA.","DOI":"10.1109\/SP.2010.25"}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/10\/6\/79\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T06:13:33Z","timestamp":1760163213000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/10\/6\/79"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,6,11]]},"references-count":43,"journal-issue":{"issue":"6","published-online":{"date-parts":[[2021,6]]}},"alternative-id":["computers10060079"],"URL":"https:\/\/doi.org\/10.3390\/computers10060079","relation":{},"ISSN":["2073-431X"],"issn-type":[{"value":"2073-431X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,6,11]]}}}