ADMIRE: Anomaly detection method using entropy-based PCA with three-step sketches

Kanda, Yoshiki; Fontugne, Romain; Fukuda, Kensuke; Sugawara, Toshiharu

doi:10.1016/j.comcom.2012.12.002

Cited by 42 publications

(25 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Also, this robust PCA approach does not require having a perfect ground-truth for training, which is one of the limitations of standard PCA discussed in [22]. In [23], the authors propose ADMIRE, which is a combination of three-step sketches and entropy-based PCA, that results in better true and false positive rates, while it is possible to capture different types of anomalies due to the different entropy time series for PCA.…”

Section: Related Workmentioning

confidence: 97%

Autonomous profile-based anomaly detection system using principal component analysis and flow analysis

Fernandes

Rodrigues

Proença

2015

Applied Soft Computing

View full text Add to dashboard Cite

Section: Related Workmentioning

confidence: 97%

Autonomous profile-based anomaly detection system using principal component analysis and flow analysis

Fernandes

Rodrigues

Proença

2015

Applied Soft Computing

View full text Add to dashboard Cite

“…Identifying anomalous events is a crucial network management task that requires automation. A great deal of attention has been paid to this problem and led to many proposals relying on statistical methods such as wavelet [1], Kalman filters [15], hash projection [3,5,10], Principal Component Analysis (PCA) [9,13], pattern recognition [8]. Due to this variety of theoretical background, these methods potentially exhibit extremely diverse behaviors regarding anomaly characteristics: volume, distributed nature, and so on.…”

Section: Introductionmentioning

confidence: 99%

Visual comparison of network anomaly detectors with chord diagrams

Mazel¹,

Fontugne²,

Fukuda³

2014

Proceedings of the 29th Annual ACM Symposium on Applied Computing

Self Cite

View full text Add to dashboard Cite

Network anomaly detection is a crucial task in traffic monitoring. During the past years, statistical algorithms have been a popular approach to this end. Network administrators are traditionally the ones that are deploying and maintaining network anomaly detection systems. They thus are in great need of information regarding detectors behaviors. However, network administrators lack techniques to further analyze and understand detection algorithms.In this paper, we present several new visualization-based analysis methods that provide in-depth detectors results analysis. These methods consequently enable a detailed account of detectors behaviors. We apply our proposal to the four anomaly detectors used in MAWILab, a documentation of anomalies located in real backbone traffic traces from the publicly available MAWI dataset. We use four years of traffic from this particular network traffic repository.Our analysis shows that: (1) observed detectors exhibit two different behaviors regarding parameter settings, (2) most detectors share a consistent proportion of their results, (3) algorithms contribute differently to the results of a detector combination strategy, and (4) we improve MAWILab ground-truth anomalies through detectors settings tuning by approximately 19 percentage points.

show abstract

“…Entropy has been studied in other contexts for anomaly detection (recently [18], and [19] applied the approach to traffic anomaly detection), but graph entropy has received little attention in the context of fault management. As a measure of graph structure it has serious computational drawbacks as its calculation is well known to be NP-Hard ( [20]), which may account for this.…”

Section: A Characteristics Of An Ideal Metricmentioning

confidence: 99%

Vertex Entropy As a Critical Node Measure in Network Monitoring

Tee

Parisis

Wakeman

2017

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

Abstract-Understanding which node failures in a network have more impact is an important problem. Current understanding, motivated by the scale free models of network growth, places emphasis on the degree of the node. This is not a satisfactory measure; the number of connections a node has does not capture how redundantly it is connected into the whole network. Conversely, the structural entropy of a graph captures the resilience of a network well, but is expensive to compute, and, being a global measure, does not attribute any specific value to a given node. This lack of locality prevents the use of global measures as a way of identifying critical nodes. In this paper we introduce local vertex measures of entropy which do not suffer from such drawbacks. In our theoretical analysis we establish the possibility that our local vertex measures approximate global entropy, with the advantage of locality and ease of computation. We establish properties that vertex entropy must have in order to be useful for identifying critical nodes. We have access to a proprietary event, topology and incident dataset from a large commercial network. Using this dataset, we demonstrate a strong correlation between vertex entropy and incident generation over events.

show abstract

ADMIRE: Anomaly detection method using entropy-based PCA with three-step sketches

Cited by 42 publications

References 14 publications

Autonomous profile-based anomaly detection system using principal component analysis and flow analysis

Autonomous profile-based anomaly detection system using principal component analysis and flow analysis

Visual comparison of network anomaly detectors with chord diagrams

Vertex Entropy As a Critical Node Measure in Network Monitoring

Contact Info

Product

Resources

About