Improving stability of PCA-based network anomaly detection by means of kernel-PCA

In the last years, the problem of detecting anomalies and attacks by statistically inspecting the network traffic has been attracting more and more research efforts. As a result, many different solutions have been proposed. Nonetheless, the poor performance offered by the proposed detection methods, as well as the difficulty of properly tuning and training these systems, make the detection of network anomalies still an open issue. In this paper, we face the problem by proposing a way to improve the performance of anomaly detection. In more detail, we propose a novel network anomaly detection method that, by means of kernel-PCA, is able to overcome the limitations of the 'classical' PCA-based methods, while retaining good performance in detecting network attacks and anomalies.