Détection d'anomalies dans les réseaux informatiques à l'aide du Big Data Analytics et de l'intelligence artificielle

Abstract

This work addresses the problem of network intrusion and anomaly detection by combining Big Data-oriented processing with deep learning models. The main objective is to design a structured and reproducible experimental pipeline capable of distinguishing benign and ma￾licious network flows in the CICIDS2017 dataset, while ensuring rigorous evaluation condi￾tions and preventing data leakage between training, validation, and testing stages. The adopted methodology includes CSV file cleaning, the selection of valid numeri￾cal flow features, the exclusion of label-related and source-identifying attributes from model inputs, the construction of a binary descriptor for benign and malicious traffic, and a strict se- iv paration of training, validation, and test subsets. Feature scaling is fitted only on the training data, and decision thresholds are calibrated on validation data. Two complementary evalua tion settings are considered : a temporal setting in which the Friday DDoS subset is reserved for the final test, and a global stratified setting covering multiple attack families. Two model families are evaluated. The Denoising Autoencoder learns the structure of benign traffic and uses reconstruction error as an anomaly score. The Hybrid CNN-MLP model combines a one-dimensional convolutional branch, designed to capture local patterns in the feature vector, with a multilayer perceptron branch, designed to model global relationships between features. The results show that the hybrid model is more suitable as a main supervised classifier when reliable labels are available, whereas the autoencoder remains useful as a complementary component for anomaly monitoring and the detection of unusual behaviors. The analysis also highlights the importance of data preprocessing quality, leakage prevention, threshold calibration, suitable metrics for imbalanced classes, and the interpretation of false positives and false negatives.