CYBERATTACK DETECTION WITH TOPOLOGICAL DATA

Discussed herein are devices, systems, and methods for detecting anomalous or malicious processes based on a network flow data. A method for network intrusion detection, the method comprising receiving a network flow data, implementing a topological data analysis (TDA) algorithm to identify respective birth and death of homological classes to which the network flow data maps, appending the respective (birth, death) pairs along with additional TDA-based features to a feature space resulting in an augmented feature space, and determining, using a machine learning algorithm the operates on the augmented feature space as input, whether the network flow data is associated with a network intrusion.