Anomaly detection: comparing different machine learning approaches

Abstract

Anomaly detection, as one of the significant applications of machine learning (ML), plays a key role in cyber security, financial risk control, medical diagnosis and other fields. However, although machine learning has been widely used in anomaly detection, there are few systematic comparative studies on different machine learning methods, making the applicability of different methods in practical applications and the improvement directions still unclear. In addition, in the field of cyber security, especially in distributed denial of service (DDoS) attack detection, how to choose suitable machine learning method and improve its detection method is still worthy of in-depth discussion. To address these gaps, this study adopts a mixed comparative approach that integrates a practical case study with a thematic literature review, systematically comparing the performance of supervised and unsupervised methods of ML, ensemble methods, and deep learning (DL) techniques in DDoS anomaly detection. By analyzing experimental results alongside existing research findings, the study not only clarifies the applicability of different machine learning methods in practical DDoS detection scenarios but also reveals current technical challenges and suggests potential directions for model optimization and future development.