Self-Supervised and Interpretable Anomaly Detection using Network
  Transformers
  Monitoring traffic in computer networks is one of the core approaches for
defending critical infrastructure against cyber attacks. Machine Learning (ML)
and Deep Neural Networks (DNNs) have been proposed in the past as a tool to
identify anomalies in computer networks. Although detecting these anomalies
provides an indication of an attack, just detecting an anomaly is not enough
information for a user to understand the anomaly. The black-box nature of
off-the-shelf ML models prevents extracting important information that is
fundamental to isolate the source of the fault/attack and take corrective
measures. In this paper, we introduce the Network Transformer (NeT), a DNN
model for anomaly detection that incorporates the graph structure of the
communication network in order to improve interpretability. The presented
approach has the following advantages: 1) enhanced interpretability by
incorporating the graph structure of computer networks; 2) provides a
hierarchical set of features that enables analysis at different levels of
granularity; 3) self-supervised training that does not require labeled data.
The presented approach was tested by evaluating the successful detection of
anomalies in an Industrial Control System (ICS). The presented approach
successfully identified anomalies, the devices affected, and the specific
connections causing the anomalies, providing a data-driven hierarchical
approach to analyze the behavior of a cyber network.
