Anomaly detection in network traffic

. The authors of this paper faced the problem of detecting anomalies, understood as potential attacks in network trafﬁc occurring on a document-signing computing cluster. In an infrastructure exposed to the public world, it is extremely difﬁcult to distinguish trafﬁc generated by users from trafﬁc generated by a network attack. The solution the authors present, based on the collected data, determines whether the trafﬁc from the selected sample originated from an attack or not, based on ready-made clustering algorithms. The performance of the following algorithms was compared: DBSCAN, LOF, COF, ECOD and PCA.