From what we have described so far, it is clear that it is not advisable to exclusively rely on automated tools for network anomaly detection, but it may be more productive to adopt AI algorithms that are able to dynamically learn how to recognize the presence of any anomalies within the network traffic, thus allowing the analyst to perform an in-depth analysis of only really suspicious cases. Now, we will demonstrate the use of different ML algorithms for network anomaly detection, which can also be used to identify a botnet.
The selected features in our example consist of the values of network latency and network throughput. In our threat model, anomalous values ​​associated with these features can be considered as representative of the presence of a botnet.
For each example, the accuracy of the algorithm is calculated...
