Early-Stage Anomaly Detection: A Study of Model Performance on Complete vs. Partial Flows

arXiv:2407.02856v1 Announce Type: cross
Abstract: This study investigates the efficacy of machine learning models, specifically Random Forest, in anomaly detection systems when trained on complete flow records and tested on partial flow data. We explore the performance disparity that arises when models are applied to incomplete data typical in real-world, real-time network environments. Our findings demonstrate a significant decline in model performance, with precision and recall dropping by up to 30\% under certain conditions when models trained on …

anomaly detection arxiv cs.cr cs.lg data detection flow forest machine machine learning machine learning models partial performance random records stage study systems