Bayesian Deep Learning for Real-Time Anomaly Detection in ICT Networks

Thesis Abstract

This study addresses the growing challenge of ensuring real-time cyber-physical security and reliable performance in modern ICT networks by integrating Bayesian deep learning to detect anomalous traffic patterns and novel intrusion behaviors with probabilistic uncertainty quantification. The aim is to develop a scalable, robust anomaly detection framework that maintains high detection accuracy while providing calibrated uncertainty estimates to support adaptive response strategies in dynamic network environments. Specific objectives are (1) to design a Bayesian deep neural architecture that fuses multi-source network telemetry (flow records, netflow, and TLS metadata) with temporal context for real-time inference; (2) to formulate principled uncertainty-aware decision rules for alert prioritization and automated mitigation; (3) to evaluate model performance under adversarial and non-stationary conditions using a large-scale, real-world dataset; (4) to compare Bayesian methods against conventional deep learning and classical statistical approaches; and (5) to operationalize the model within a simulated ICT network environment to assess latency, throughput, and resilience. The methodology adopts a quantitative, design?science–inspired approach grounded in Bayesian statistics and deep learning theory. The population comprises enterprise-grade network traffic datasets collected from a metropolitan backbone network and a university campus network over six months, totaling approximately 12 terabytes of heterogeneous telemetry. A stratified sampling strategy yields a labeled subset of 5 million flow records, including known benign traffic and annotated attack instances (e.g., DDoS, reconnaissance, and data exfiltration). Data collection instruments consist of high-fidelity packet capture, sFlow/NetFlow exporters, TLS handshake metadata, and system log streams, synchronized via Network Time Protocol. The model leverages a temporal Bayesian neural network (TBNN) with variational inference to produce probabilistic outputs and calibrated posterior distributions over anomaly scores. Feature engineering draws on flow-level statistics, feature dictionaries for categorical fields, and time-series primitives (rolling means, variances, and autocorrelation). Model validation employs nested cross-validation and time-split evaluation to mirror deployment conditions. Analytical techniques include construction of a Bayesian convolutional-recurrent architecture to capture spatial-temporal patterns, variational Bayes for posterior approximation, and Monte Carlo dropout as a practical surrogate for uncertainty estimation. Performance metrics encompass precision, recall, F1-score, area under the precision-recall curve (AUPRC), and calibration error (reliability diagrams). Hypothesis testing compares the Bayesian model against a non-Bayesian deep detector and a classical statistical baseline using paired McNemar tests and Diebold–Mariano for predictive accuracy under non-stationarity. The study also analyzes the value of uncertainty quantification by examining the correlation between predictive entropy and incident severity, and by simulating adaptive response strategies triggered by alarm confidence. Expected findings indicate that the Bayesian deep learning framework achieves superior detection with high recall (>0.92) and precision (>0.94) on labeled attack instances while maintaining well-calibrated uncertainty (expected calibration error < 0.03). It is anticipated that posterior uncertainty will effectively prioritize alerts under concept drift, reducing false alarms by up to 28% relative to non-Bayesian baselines. The study is likely to reveal that incorporating TLS metadata and temporal context substantially improves detection of stealthy and low-slow attacks that evade traditional flow-based detectors. The research also anticipates demonstrating that calibrated uncertainty enables safer automated remediation, by deferring decisions when confidence is low and recommending human-in-the-loop analysis for high-stake events. Contribution to knowledge includes (i) a novel Bayesian deep learning architecture tailored for real-time ICT network anomaly detection with explicit uncertainty quantification; (ii) empirical evidence on the benefits of probabilistic outputs for adaptive incident response; (iii) methodological guidance for integrating multi-source network telemetry in probabilistic deep models; and (iv) a reproducible evaluation pipeline and benchmark dataset with baselines to facilitate future research. The main conclusion posits that uncertainty-aware Bayesian deep learning offers a robust, scalable path to real-time network security analytics, enabling more reliable anomaly detection and more informed, cost-effective automated responses. Recommended directions for practice include deploying the model in edge and fog computing environments with streamlined inference, continuously updating priors to reflect evolving threat landscapes, and integrating human-in-the-loop decision frameworks to leverage uncertainty judgments in high-risk scenarios.