2026-09-19T19:10:40Zhttps://dspace.mit.edu/server/oai/requestoai:dspace.mit.edu:1721.1/1452262025-10-30T15:50:01Zcom_1721.1_7582com_1721.1_7581col_1721.1_131023
Abel Sanchez.
Dowmon, Nicholas H.
Massachusetts Institute of Technology. Engineering Systems Division.
System Design and Management Program.
Massachusetts Institute of Technology. Engineering Systems Division
System Design and Management Program.
2022-08-31T16:29:17Z
2022-08-31T16:29:17Z
2020
2020
https://hdl.handle.net/1721.1/145226
1341991441
Thesis: S.M. in Engineering and Management, Massachusetts Institute of Technology, Engineering Systems Division, System Design and Management Program, 2020
Cataloged from PDF version of thesis.
Includes bibliographical references (pages 89-92).
The goal of this research is to develop a framework for detecting anomalies in network traffic data on highly complex computer networks. In this research, I present the Ensemble Outlier Detection System, a new framework for detecting anomalies in multidimensional network traffic data. The system meets six design requirements which ensure that the system can meet the needs of the sponsor organization's cybersecurity teams both now and in the future. In particular, this system improves on many existing anomaly detection systems by maintaining scalability for extremely large computer networks and resiliency to non-stationary data, re-establishing its own baselines as the network changes over time. I also present the Explorer tool, designed for cybersecurity analysts to interpret the cause of high anomaly scores on certain data points and to annotate each data point atomically. I ensure scalability by treating all fields in a data point as independent of one another. Preliminary results suggest that this treatment will not affect system performance, as many anomalous data points exhibit multiple anom-alous -fields-at- a time, increasing the outlier predictions for the data point using recursive aggregation. The system successfully detects and presents interpretations of various anomalies in network traffic from the sponsoring institution's dataset, and achieves performance values which can detect real-time anomalies in enterprise computer networks.
by Nicholas Dowmon.
S.M. in Engineering and Management
S.M. in Engineering and Management Massachusetts Institute of Technology, Engineering Systems Division, System Design and Management Program
92 pages
eng
Massachusetts Institute of Technology
MIT theses may be protected by copyright. Please reuse MIT thesis content according to the MIT Libraries Permissions Policy, which is available through the URL provided.
http://dspace.mit.edu/handle/1721.1/7582
Engineering Systems Division.
System Design and Management Program.
A generic framework for detecting interpretable real-time anomalies in network traffic data
Thesis
application/pdf
2022-08-31T16:29:17Z
Publication
Master
Sloan
unknown
unknown
<Publication xmlns="https://www.openaire.eu/cerif-profile/1.1/" id="f5aca95d-bc26-4035-be34-c20a657e1a52">
<Type xmlns="https://www.openaire.eu/cerif-profile/vocab/COAR_Publication_Types">http://purl.org/coar/resource_type/c_1843</Type>
<Language>eng</Language>
<Title>A generic framework for detecting interpretable real-time anomalies in network traffic data</Title>
<PublishedIn>
<Publication>
</Publication>
</PublishedIn>
<PublicationDate>2020</PublicationDate>
<Authors>
<Author>
<DisplayName>Dowmon, Nicholas H.</DisplayName>
<Affiliation>
<OrgUnit>
</OrgUnit>
</Affiliation>
</Author>
</Authors>
<Editors>
</Editors>
<Publishers>
<Publisher>
<DisplayName>Massachusetts Institute of Technology</DisplayName>
<OrgUnit />
</Publisher>
</Publishers>
<License>http://dspace.mit.edu/handle/1721.1/7582</License>
<Keyword>Engineering Systems Division.</Keyword>
<Keyword>System Design and Management Program.</Keyword>
<Abstract>The goal of this research is to develop a framework for detecting anomalies in network traffic data on highly complex computer networks. In this research, I present the Ensemble Outlier Detection System, a new framework for detecting anomalies in multidimensional network traffic data. The system meets six design requirements which ensure that the system can meet the needs of the sponsor organization's cybersecurity teams both now and in the future. In particular, this system improves on many existing anomaly detection systems by maintaining scalability for extremely large computer networks and resiliency to non-stationary data, re-establishing its own baselines as the network changes over time. I also present the Explorer tool, designed for cybersecurity analysts to interpret the cause of high anomaly scores on certain data points and to annotate each data point atomically. I ensure scalability by treating all fields in a data point as independent of one another. Preliminary results suggest that this treatment will not affect system performance, as many anomalous data points exhibit multiple anom-alous -fields-at- a time, increasing the outlier predictions for the data point using recursive aggregation. The system successfully detects and presents interpretations of various anomalies in network traffic from the sponsoring institution's dataset, and achieves performance values which can detect real-time anomalies in enterprise computer networks.</Abstract>
<Access xmlns="http://purl.org/coar/access_right"
>
</Access>
</Publication>