Anomaly Detection As-a-Service

Mobilio, Marco; Orrù, Marisa; Riganelli, Oliviero; Tundo, Alessandro; Mariani, Leonardo

doi:10.1109/issrew.2019.00071

Cited by 10 publications

(7 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the following section, some indicative research on the subject, focusing on systems that use AI for IoT cyber security, is presented. In [4], anomaly detection-as-a-Service is proposed on top of VARYS-a technology-agnostic Monitoring-As-a-Service framework. The conducted work addresses the detection of anomalies in an efficient way as part of a holistic system where operators can configure monitoring and detecting services.…”

Section: Related Workmentioning

confidence: 99%

Time Series Network Data Enabling Distributed Intelligence—A Holistic IoT Security Platform Solution

et al. 2022

View full text Add to dashboard Cite

The Internet of Things (IoT) encompasses multiple fast-emerging technologies controlling and connecting millions of new devices every day in several application domains. The increased number of interconnected IoT devices, their limited computational power, and the evolving sophistication of cyber security threats, results in increased security challenges for the IoT ecosystem. The diversity of IoT devices, and the variety of QoS requirements among several domains of IoT application, impose considerable challenges in designing and implementing a robust IoT security solution. The aim of this paper is to present an efficient, robust, and easy-to-use system, for IoT cyber security operators. Following a by-design security approach, the proposed system is a platform comprising four distinct yet cooperating components; a distributed AI-enhanced detection of potential threats and anomalies mechanisms, an AI-based generation of effective mitigation strategies according to the severity of detected threats, a system for the verification of SDN routing decisions along with network- and resource-related policies, and a comprehensive and intuitive security status visualization and analysis. The distributed anomaly detection scheme implementing multiple AI-powered agents is deployed across the IoT network nodes aiming to efficiently monitor the entire network infrastructure. Network traffic data are fed to the AI agents, which process consecutive traffic samples from the network in a time series analysis manner, where consecutive time windows framing the traffic of the surrounding nodes are processed by a graph neural network algorithm. Any detected anomalies are handled by a mitigation engine employing a distributed neural network algorithm, which exploits the recorded anomalous events and deploys appropriate responses for optimal threat mitigation. The implemented platform also includes the hypothesis testing module, and a multi-objective optimization tool for the quick verification of routing decisions. The system incorporates visualization and analytics functionality and a customizable user interface.

show abstract

Section: Related Workmentioning

confidence: 99%

Time Series Network Data Enabling Distributed Intelligence—A Holistic IoT Security Platform Solution

et al. 2022

View full text Add to dashboard Cite

show abstract

“…Mobilio et al [17] presented Cloud-based anomaly detection as a service that used the as-a-service paradigm exploited in cloud systems to announce the anomaly detection logic's control. They also proposed early results with lightweight detectors displaying a promising solution to better control anomaly detection logic.…”

Section: Cloud-based Techniquesmentioning

confidence: 99%

Apply machine learning techniques to detect malicious network traffic in cloud computing

Alshammari

Aldribi

2021

J Big Data

View full text Add to dashboard Cite

Computer networks target several kinds of attacks every hour and day; they evolved to make significant risks. They pass new attacks and trends; these attacks target every open port available on the network. Several tools are designed for this purpose, such as mapping networks and vulnerabilities scanning. Recently, machine learning (ML) is a widespread technique offered to feed the Intrusion Detection System (IDS) to detect malicious network traffic. The core of ML models’ detection efficiency relies on the dataset’s quality to train the model. This research proposes a detection framework with an ML model for feeding IDS to detect network traffic anomalies. This detection model uses a dataset constructed from malicious and normal traffic. This research’s significant challenges are the extracted features used to train the ML model about various attacks to distinguish whether it is an anomaly or regular traffic. The dataset ISOT-CID network traffic part uses for the training ML model. We added some significant column features, and we approved that feature supports the ML model in the training phase. The ISOT-CID dataset traffic part contains two types of features, the first extracted from network traffic flow, and the others computed in specific interval time. We also presented a novel column feature added to the dataset and approved that it increases the detection quality. This feature is depending on the rambling packet payload length in the traffic flow. Our presented results and experiment produced by this research are significant and encourage other researchers and us to expand the work as future work.

show abstract

“…Related to our work, Mobilio et al [22] studied how to dynamically deploy and undeploy lightweight anomaly detectors in cloud systems. In the context of their evaluation, they considered HTM among the set of the anomaly detectors that can be deployed.…”

Section: B Failure Prediction In Cloud Environmentsmentioning

confidence: 99%

“…HTM continually updates models as new data to analyze become available. While successfully applied in many other contexts [15]- [21], it has received little attention in the context of cloud failure prediction, with only a preliminary study by Mobilio et al considering its usage [22].…”

Section: Introductionmentioning

confidence: 99%

Cloud Failure Prediction with Hierarchical Temporal Memory: An Empirical Assessment

Riganelli¹,

Saltarel²,

Tundo³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Hierarchical Temporary Memory (HTM) is an unsupervised learning algorithm inspired by the features of the neocortex that can be used to continuously process stream data and detect anomalies, without requiring a large amount of data for training nor requiring labeled data. HTM is also able to continuously learn from samples, providing a model that is always up-to-date with respect to observations. These characteristics make HTM particularly suitable for supporting online failure prediction in cloud systems, which are systems with a dynamically changing behavior that must be monitored to anticipate problems. This paper presents the first systematic study that assesses HTM in the context of failure prediction.The results that we obtained considering 72 configurations of HTM applied to 12 different types of faults introduced in the Clearwater cloud system show that HTM can help to predict failures with sufficient effectiveness (F-measure = 0.76), representing an interesting practical alternative to (semi-)supervised algorithms.

show abstract

Anomaly Detection As-a-Service

Cited by 10 publications

References 22 publications

Time Series Network Data Enabling Distributed Intelligence—A Holistic IoT Security Platform Solution

Time Series Network Data Enabling Distributed Intelligence—A Holistic IoT Security Platform Solution

Apply machine learning techniques to detect malicious network traffic in cloud computing

Cloud Failure Prediction with Hierarchical Temporal Memory: An Empirical Assessment

Contact Info

Product

Resources

About