A refined filter for UHAD to improve anomaly detection

Abstract

Filtering is used in intrusion detection to remove the insignificant events from a log to facilitate the analysis method to focus on the significant events and to minimize processing overhead. Generally, filtering is performed using filtering rules, which are framed using a set of data (training data), or the known facts on anomalous events. This knowledge‐dependent nature confines the filterer to filter‐in only the recognized anomalies in the logs, making the rest unavailable for further scrutiny. This problem has been addressed earlier by designing a filterer that manipulates the tested log data based on the patterns and volume of events to calculate the filtering threshold. Even though this filtering threshold was able to retain the anomalous events in most heterogeneous logs, it failed when such events were of high volume and also due to the inaccuracies in cluster formation. Therefore, this paper proposes a refined filterer for unsupervised heterogeneous anomaly detection that retains most anomalous events irrespective of its volume in the logs and also discusses the impact of the refined filterer in supporting the detection. The experiment conducted reveals that the refined filterer retained almost all the abnormal events thereby enabling the detection of maximum anomalies. Copyright © 2016 John Wiley & Sons, Ltd.

Prediction of Lecturer Performance using Machine Learning Techniques

“…The precision created by 65.14% accuracy was provided by ID3, 72.32% by CART, 75.00% by LAD Tree, and 80.35% accuracy was generated by NB classifier. Several machine learning techniques such as Naive Bayes, K-Nearest Neighbors, Random Forests, Support Vector Machines, and Decision Trees have been studied in the paper published by Vijayalakshmi et al It was improved than other models using the dataset at hand (Asif Iqbal Hajamydeen, 2016). R is a computer language used for data mining applications.…”

A Detailed Description on Unsupervised Heterogeneous Anomaly Based Intrusion Detection Framework

“…The limitation of the filtering component deployed in UHAD [10] is further improved with the refined filterer [52] by increasing the volume of retained abnormal events; hence, the other components of the framework [52] in are basically the same as UHAD [10]. The aim of the refined filterer is to retain all the abnormal events in the log for subsequent processing, irrespective of the existence of such events in larger number in the logs and the inaccuracies in clustering.…”

“…Moreover, a portion of the results on the other three subsets, i.e., subset-2, subset-3, subset-4, were mentioned in Hajamydeen et.al. [52] for comparison purposes, but not detailed.…”