Automated detection of network security anomalies using a denoising diffusion probabilistic model

A method for detecting and scoring security anomalies in a computing environment, the method including:

• receiving a network traffic event for the computing environment;
• parsing, with an electronic processor, the network traffic event to extract a feature set describing the network traffic event;
• applying, with the electronic processor, noise to the feature set to produce a noised feature set;
• producing a reduced noise feature set by processing the noised feature set using a neural network trained to remove noise;
• comparing, with the electronic processor, the reduced noise feature set to the feature set to determine a success score;
• determining whether the success score exceeds a threshold;
• and
• responsive to determining that the success score does not exceed the threshold, labeling the network traffic event as anomalous.

A non-transitory computer-readable medium containing executable instructions that, when executed by one or more electronic processors, cause the one or more electronic processors to:

• receive, via a communication interface, a network traffic event for a computing environment;
• parse the network traffic event to extract a feature set describing the network traffic event;
• apply noise to the feature set to produce a noised feature set;
• produce a reduced noise feature set by processing the noised feature set using a neural network trained to remove noise;
• compare the reduced noise feature set to the feature set to determine a success score;
• determine whether the success score exceeds a threshold;
• and
• responsive to determining that the success score does not exceed the threshold, label the network traffic event as anomalous.