Abnormal Network Traffic Detection Based on Improved LOF Algorithm

Gan, Zongxin; Zhou, Xiaofeng

doi:10.1109/ihmsc.2018.00040

Cited by 21 publications

(11 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These are considered outliers. The main idea of the algorithm is to determine the outlier data set of abnormal points by calculating the outlier factor for each data point in the data set [35]. The larger the value of the outlier factor corresponding to the data object, the fewer the number of data points around the object [36].…”

Section: Unsupervised Machine Learning: Local Outlier Factor Algormentioning

confidence: 99%

An Unsupervised Detection Approach for Hardware Trojans

et al. 2020

View full text Add to dashboard Cite

With the booming development of the cyber-physical system, human society is much more dependent on information technology. Unfortunately, like software, hardware is not trusted at all, due to so many third parties involved in the separated integrated circuit's (IC) design and manufacturing stages for the high profit. The malicious circuits (named Hardware Trojans) can be implanted during any stage of the ICs' design and manufacturing process. However, the existing pre-silicon approaches based on machine learning theory have good performance, they all belong to supervised learning methods, which have a key prerequisite that is numerous already known information. Meanwhile, hardware Trojans are even more unimaginable because today's ICs are becoming more complicated. The known information is even harder to gain. Furthermore, the training process for supervised learning methods tends to be time-consuming and generally requires a huge amount of balanced training data. Therefore, this paper proposes an unsupervised hardware Trojans detection approach by combined the principal component analysis (PCA) and local outlier factor (LOF) algorithm, called PL-HTD. We firstly visualize the distribution features of normal nets and Trojan nets, and then reveal the differences between the two types of nets to reduce the dimension of the feature set. According to the outliers of each net, the abnormal nets are selected and verified by professionals later to confirm whether it is a true Trojan relative to the host circuit to realize the detection. The experiments show that the proposed method can detect hardware Trojans effectively and reduce the cost of manual secondary detection. For the Trust-HUB benchmarks, the PL-HTD achieves up to 73.08% TPR and 97.52% average TNR, moreover, it achieves average 96.00% accuracy, which shows the feasibility and efficiency of hardware Trojans detecting by employing a method without the guidance of class label information. INDEX TERMS hardware security, hardware Trojan detection, integrated circuit, unsupervised machine learning, LOF

show abstract

Section: Unsupervised Machine Learning: Local Outlier Factor Algormentioning

confidence: 99%

An Unsupervised Detection Approach for Hardware Trojans

et al. 2020

View full text Add to dashboard Cite

show abstract

“…ii) Support vector machine (SVM). Miao et al [25] proposed a distributed online one-class [32] Support vector machine Ou et al [33], Babaei et al [34] Neural network Wazid and Das [35] Nearest neighbor KNN Ghezelbash et al [36] Relative density Schmutz et al [37], Krishnaveni et al [38] Clustering Regular clustering Xiang et al [39] Co-clustering Zhai et al [40] SVM algorithm to discover anomalous data via wireless sensor networks and get a decentralized loss function. iii) Neural networks.…”

Section: ) Classificationmentioning

confidence: 99%

“…ii) Relative density-based method. Gan et al [32] proposed a method using an improved local outlier factor (LOF) algorithm for implementing adaptive dynamic adjustment of parameters in network traffic scenarios.…”

Section: ) Classificationmentioning

confidence: 99%

Anomaly detection for electricity consumption in cloud computing: framework, methods, applications, and challenges

Feng

Zhang

et al. 2020

J Wireless Com Network

View full text Add to dashboard Cite

Driven by industrial development and the rising population, the upward trend of electricity consumption is not going to curb. While the electricity suppliers make every endeavor to satisfy the needs of consumers, they are facing the plight of indirect losses caused by technical or non-technical factors. Technical losses are usually induced by short circuits, power outage, or grid failures. The non-technical losses result from humans’ improper behaviors, e.g., electricity burglars. Due to the restrictions of the detection methods, the detection rate in the traditional power grid is lousy. To provide better electricity service for the customers and minimize the losses for the providers, a leap in the power grid is occurring, which is referred to as the smart grid. The smart grid is envisioned to increase the detection accuracy to an acceptable level by utilizing modern technologies, such as cloud computing. With the aim of obtaining achievements of anomaly detection for electricity consumption with cloud computing, we firstly introduce the basic definition of anomaly detection for electricity consumption. Next, we conduct the surveys on the proposed framework of anomaly detection for electricity consumption and propose a new framework with cloud computing. This is followed by centralized and decentralized detection methods. Then, the applications of centralized and decentralized detection methods for the anomaly electricity consumption are listed. Finally, the open challenges of the accuracy of detection and anomaly detection for electricity consumption with edge computing are discussed.

show abstract

“…For floating small target detection in sea-surface, anomaly detection algorithms only need easily-obtained sea clutter samples for training detection models, which is more suitable for the problem. Local outlier factor (LOF) [20], [21], one-class SVM (OCSVM) [22], [23], robust covariance [24] and isolation forest (iForest) algorithm [25], [26] are the representative anomaly detection algorithms. Inspired by the convexhull-class detector, this paper proposes a multifeature detector based on iForest algorithm.…”

Section: Introductionmentioning

confidence: 99%

“…Therefore, a large number of classification methods need to get two kinds of samples to train the classifier [12], [17], but in the problem we need to solve, this condition is obviously not satisfied. But anomaly detection algorithms of machine learning can be utilized [20], [25], especially for the feature-based detection methods. In this way, sea clutter feature extracted from pre-received radar returns are regarded as normal samples and used to build anomaly detection model.…”

Section: B the Introduction Of Iforest Algorithm For Floating Small mentioning

confidence: 99%

Sea-Surface Floating Small Target Detection by Multifeature Detector Based on Isolation Forest

Zhu

Jiang

et al. 2021

IEEE J. Sel. Top. Appl. Earth Observations Remote Sensing

View full text Add to dashboard Cite

In this paper, a multi-feature detector based on isolation forest (iForest) algorithm is developed to detect floating small targets in sea clutter. The conventional multi-feature detector can only process three features or less. The proposed detector aims to break the limitation of feature dimensions' number of the existed feature-based detectors and to improve the detection performance. It transforms the detection of floating small target into an anomaly detection problem in a high-dimensional feature space, breaking the limitation of the number of features. Firstly, a modified isolation forest is constructed from multiple features extracted from sea clutter. Meanwhile, the relative Doppler coefficient of variation (RCV) is proposed and added into the feature library. Then, taking the average path length as detection statistic, the detection threshold is obtained by Monte-Carlo technique at the given false alarm probability (PFA). Finally, the final decision is made by comparing the path length calculated from the cell under test (CUT) of radar returns with the detection threshold. Detection performances are evaluated based on twenty measured IPIX radar data sets. The experiment results show that the multi-feature detector based on isolation forest can obtain a significant performance improvement and has lower computation cost compared with the existed detectors.

show abstract

Abnormal Network Traffic Detection Based on Improved LOF Algorithm

Cited by 21 publications

References 7 publications

An Unsupervised Detection Approach for Hardware Trojans

An Unsupervised Detection Approach for Hardware Trojans

Anomaly detection for electricity consumption in cloud computing: framework, methods, applications, and challenges

Sea-Surface Floating Small Target Detection by Multifeature Detector Based on Isolation Forest

Contact Info

Product

Resources

About