BLADE: Behavior-Level Anomaly Detection Using Network Traffic in Web Services

2025-11-07

AI Summary

Existing traffic anomaly detection methods primarily focus on flow-level attacks and struggle to identify stealthy behavior-level attacks—where individual flows appear benign, yet cross-flow coordination reveals malicious intent. To address this, we propose an unsupervised behavior-level anomaly detection system for web services. It is the first to introduce behavior-level modeling into web security: a flow autoencoder extracts latent multi-flow features and computes reconstruction loss; unsupervised clustering generates pseudo-operation labels; and a triplet comprising timestamps, pseudo-labels, and anomaly scores is fed into a one-class classifier for fine-grained behavioral modeling. Evaluated on a custom dataset and CIC-IDS2017, our method achieves F1-scores of 0.9732 and 0.9801, respectively—significantly outperforming conventional single-flow approaches.

Technology Category

• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Machine Learning: Unsupervised & Self-Supervised Learning
• Multiagent Systems: Agent-Based Simulation and Emergent Behavior

Application Category

• Web Mining and Content Analysis: Normalization, clustering, classification, and summarization of Web text
• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs
• Responsible Web: Machine-in-the-loop, human agency and autonomy

Abstract

With their widespread popularity, web services have become the main targets of various cyberattacks. Existing traffic anomaly detection approaches focus on flow-level attacks, yet fail to recognize behavior-level attacks, which appear benign in individual flows but reveal malicious purpose using multiple network flows. To transcend this limitation, we propose a novel unsupervised traffic anomaly detection system, BLADE, capable of detecting not only flow-level but also behavior-level attacks in web services. Our key observation is that application-layer operations of web services exhibit distinctive communication patterns at the network layer from a multi-flow perspective. BLADE first exploits a flow autoencoder to learn a latent feature representation and calculates its reconstruction losses per flow. Then, the latent representation is assigned a pseudo operation label using an unsupervised clustering method. Next, an anomaly score is computed based on the reconstruction losses. Finally, the triplets of timestamps, pseudo labels, and anomaly scores from multiple flows are aggregated and fed into a one-class classifier to characterize the behavior patterns of legitimate web operations, enabling the detection of flow-level and behavior-level anomalies. BLADE is extensively evaluated on both the custom dataset and the CIC-IDS2017 dataset. The experimental results demonstrate BLADE's superior performance, achieving high F1 scores of 0.9732 and 0.9801, respectively, on the two datasets, and outperforming traditional single-flow anomaly detection baselines.

Problem

• Detects behavior-level cyberattacks using multi-flow network patterns
• Identifies malicious operations appearing benign in individual flows
• Transcends flow-level limitations with unsupervised anomaly detection

Innovation

• Unsupervised autoencoder learns latent flow features
• Clustering assigns pseudo labels to network operations
• One-class classifier aggregates multi-flow behavior patterns