Method and arrangement for detecting anomalies in network data traffic

A non-transitory computer readable medium, having thereon a computer program comprising program instructions, the computer program being loadable into a data processing unit and configured to cause execution of a method when the computer program is run by the data processing unit, wherein the method is for creating a model for detecting anomalies in network data traffic between devices in a first part of a network and devices in a second part of the network, and wherein the method comprises:

• collecting feature samples of network data traffic at a monitoring point between a first and a second part of the network, and
• training the model for detecting anomalies on the collected feature samples using a plurality of anomaly detection, AD, trees;
• wherein training comprises creating the plurality of AD trees using respective subsets of the collected feature samples, at least some of the AD tree comprising subspace selection nodes and anomaly-catching nodes to a predetermined AD tree depth limit D, wherein each subspace selection node is arranged to bisect a set of feature samples reaching the subspace selection node based on a value chosen from within a first interval that is an interval of the set of feature samples reaching the subspace selection node and each anomaly-catching node is arranged to bisect a set of feature samples reaching the anomaly-catching node based on a value chosen from a second interval that includes one or more values outside the first interval, and wherein each subspace selection node is arranged to bisect a set of feature samples reaching the subspace selection node to at least one anomaly-catching node when a number of feature samples leaving the subspace selection node for the at least one anomaly-catching node is below a predetermined threshold.

An apparatus for creating a model for detecting anomalies in network data traffic between devices in a first part of a network and devices in a second part of the network, the apparatus comprising processing circuitry configured to cause:

• collection of feature samples of network data traffic between the first and second part of the network;
• and
• training of an anomaly detection model on the collected feature samples using a plurality of anomaly detection, AD, trees,
• wherein training comprises creating the plurality of AD trees T using a subset of the collected feature samples, at least some of the AD trees comprising subspace selection nodes and anomaly-catching nodes to a predetermined AD tree depth limit D, wherein each subspace selection node is arranged to bisect a set of feature samples reaching the subspace selection node based on a value chosen from within a first interval that is an interval of the set of feature samples reaching the subspace selection node and each anomaly-catching node is arranged to bisect a set of feature samples reaching the anomaly-catching node based on a value chosen from a second interval that includes one or more values outside the first interval, and wherein each subspace selection node is arranged to bisect a set of feature samples reaching the subspace selection node to at least one anomaly-catching node when a number of feature samples leaving the subspace selection node for the at least one anomaly-catching node is below a predetermined threshold.