Paper, 2025.06

Shadow IT Detection via Unsupervised Embedding-Based Clustering of Network Traffic

Detecting Shadow IT, meaning apps and services used without the organization's approval, is hard with supervised traffic classifiers because they need labeled data and do not generalize to newly appearing apps. This domestic conference paper preprocesses packets into fixed-length vectors based on a 1,500-byte MTU so that the method does not depend on payload content, learns latent representations with a 1D convolutional autoencoder, and refines the clusters with Deep Embedded Clustering (DEC); clusters that stand apart from the approved apps are flagged as Shadow IT. Joonho Seo wrote the paper as first author and presented it. It was given as an oral presentation in the network/cloud security session of the KIISC Summer Conference (CISC-S'25) on June 24, 2025. The work was at the prototype stage, and the paper does not include quantitative experimental results.

Where

KIISC Conference on Information Security and Cryptography Summer 2025 (CISC-S 2025)

My role

First author and presenter

Status

published