Basically I would like to look at three major problems which most research are using supervised Machine learning methods to identify these abnormal traffic;
1. feature identification and recognition.
2. Gain higher accuracy.
3. Find out algorithm reaction to new indirect attacks.
A new and innovative way to gain insight into sensitive features and models is interpretable machine learning. The shap library is highly recommended for this purpose: https://github.com/slundberg/shap
Your procedure could look like this:
1. Collect features from literature
2. Add your features
3. Create for example a xgboost model and check if the relationship can be modelled well
4. If yes -> perform the shap analysis
You will learn how sensitive individual features are and how the interactions look like.