Network anomaly detection is an important and dynamic research area. Many network intrusion detection methods and systems (NIDS) have been proposed in the literature. In this paper, we provide a structured and comprehensive overview of various facets of network anomaly detection so that a researcher can become quickly familiar with every aspect of network anomaly detection. We present attacks normally encountered by network intrusion detection systems. We categorize existing network anomaly detection methods and systems based on the underlying computational techniques used. Within this framework, we briefly describe and compare a large number of network anomaly detection methods and systems. In addition, we also discuss tools that can be used by network defenders and datasets that researchers in network anomaly detection can use. We also highlight research directions in network anomaly detection.

Network Anomaly Detection: Methods, Systems and Tools

https://romisatriawahono.net/lecture/rm/survey/network%20security/Modi%20-%20Intrusion%20Detection%20in%20Cloud%20-%202013.pdf

Review: A survey of intrusion detection techniques in Cloud

https://romisatriawahono.net/lecture/rm/survey/network%20security/Patel%20-%20Intrution%20Detection%20System%20in%20Cloud%20-%202013.pdf

Review: An intrusion detection and prevention system in cloud computing: A systematic review

Practical real-time intrusion detection using machine learning approaches

Anomaly detection (AD) use within the network intrusion detection field of research, or network intrusion AD (NIAD), is dependent on the proper use of similarity and distance measures, but the measures used are often not documented in published research. As a result, while the body of NIAD research has grown extensively, knowledge of the utility of similarity and distance measures within the field has not grown correspondingly. NIAD research covers a myriad of domains and employs a diverse array of techniques from simple $k$ -means clustering through advanced multiagent distributed AD systems. This review presents an overview of the use of similarity and distance measures within NIAD research. The analysis provides a theoretical background in distance measures and a discussion of various types of distance measures and their uses. Exemplary uses of distance measures in published research are presented, as is the overall state of the distance measure rigor in the field. Finally, areas that require further focus on improving the distance measure rigor in the NIAD field are presented.

Ming-Yang Su

Papers

A real-time network intrusion detection system for large-scale attacks based on an incremental mining approach

WARP: A wormhole-avoidance routing protocol by anomaly detection in mobile ad hoc networks