A latent class modeling approach to detect network intrusion

This study presents a latent class modeling approach to examine network traffic data when labeled abnormal events are absent in training data, or such events are insufficient to fit a conventional regression model. Using six anomaly-associated risk factors identified from previous studies, the latent class model based on an unlabeled sample yielded acceptable classification results compared with a logistic regression model based on a labeled sample (correctly classified: 0.95 vs. 0.98, sensitivity: 0.99 vs. 0.99, and specificity: 0.77 vs. 0.97). The study demonstrates a great potency for using the latent class modeling technique to analyze network traffic data.