Anomaly Detection Using Nonnegative Matrix Factorization

Allan, Edward G.; Horvath, Michael; Kopek, Christopher V.; Lamb, Brian; Whaples, Thomas S.; Berry, Michael W.

doi:10.1007/978-1-84800-046-9_11

Cited by 10 publications

(9 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A variety of classical factorization techniques, such as Principle Component Analysis (PCA) [8] and Non-negative Matrix Factorization (NMF) [9], have been applied to detect anomalies using reconstruction error as a metric. These techniques extract "normal" patterns hidden in the data to perform dimensionality reduction.…”

Section: A Anomaly Detectionmentioning

confidence: 99%

Multi-Dimensional Anomalous Entity Detection via Poisson Tensor Factorization

Eren

Moore

Alexandro

2020

2020 IEEE International Conference on Intelligence and Security Informatics (ISI)

View full text Add to dashboard Cite

As the attack surfaces of large enterprise networks grow, anomaly detection systems based on statistical user behavior analysis play a crucial role in identifying malicious activities. Previous work has shown that link prediction algorithms based on non-negative matrix factorization learn highly accurate predictive models of user actions. However, most statistical link prediction models have been constructed on bipartite graphs, and fail to capture the nuanced, multi-faceted details of a user's activity profile. This paper establishes a new benchmark for red team event detection on the Los Alamos National Laboratory Unified Host and Network Dataset by applying a tensor factorization model that exploits the multi-dimensional and sparse structure of user authentication logs. We show that learning patterns of normal activity across multiple dimensions in one unified statistical framework yields improved detection of penetration testing events. We further show operational value by developing fusion methods that can identify anomalous users, source devices, and destination devices in the network.

show abstract

Section: A Anomaly Detectionmentioning

confidence: 99%

Multi-Dimensional Anomalous Entity Detection via Poisson Tensor Factorization

Eren

Moore

Alexandro

2020

2020 IEEE International Conference on Intelligence and Security Informatics (ISI)

View full text Add to dashboard Cite

show abstract

“…A stoplist of 493 words 1 was used by GTP to filter out unimportant terms. Initial testing of NMF with ASRS documents with NMF used as many as n = 21, 519 documents (see [23]). In comparing the classification performance of NMF and NMU, we use only the first n = 100 documents for this study.…”

Section: Document Parsing and Term Weightingmentioning

confidence: 99%

“…The classification of ASRS documents using NMF and NMU follows the strategy first discussed in [23]. Let H i represent the i-th column of matrix H and define α, as a the threshold on the relevance score or (target value) t ij for document i and anomaly/label j.…”

Section: Nmf/nmu Classificationmentioning

confidence: 99%

“…Let σ denote the percentage of documents used to define the training set (or number of columns of R). Table I briefly summarizes the steps needed (see [23] for more details) to classify ASRS documents using matrix factors (W, H) generated by NMF or NMU. For all NMU-based classifications, the choices µ 0 = 2 and ρ = 0.35 (see Equation (3)) yielded the best results.…”

Section: Nmf/nmu Classificationmentioning

confidence: 99%

“…The fourteen (of the twenty-two) event types (or anomaly descriptions) listed in Table II were obtained from the Distributed National ASAP Archive (DNAA) maintained by the University of Texas Human Factors Research Project 4 . As the specificity of some topics in the ASRS collection can widely vary [23], it is not surprising to observe poor performance for both classifiers with a few anomaly categories (e.g., 2, 6, 7, and 22). Additional experiments with a larger numbers of features (k > 10) and documents (n > 100) should produce NMF and NMU models that better capture the diversity of contexts described by those events.…”

mentioning

confidence: 99%

See 2 more Smart Citations

Document classification using nonnegative matrix factorization and underapproximation

Berry

Gillis

Glineur

2009

2009 IEEE International Symposium on Circuits and Systems

Self Cite

View full text Add to dashboard Cite

Abstract-In this study, we use nonnegative matrix factorization (NMF) and nonnegative matrix underapproximation (NMU) approaches to generate feature vectors that can be used to cluster Aviation Safety Reporting System (ASRS) documents obtained from the Distributed National ASAP Archive (DNAA). By preserving nonnegativity, both the NMF and NMU facilitate a sum-of-parts representation of the underlying term usage patterns in the ASRS document collection. Both the training and test sets of ASRS documents are parsed and then factored by both algorithms to produce a reduced-rank representations of the entire document space. The resulting feature and coefficient matrix factors are used to cluster ASRS documents so that the (known) associated anomalies of training documents are directly mapped to the feature vectors. Dominant features of test documents are then used to generate anomaly relevance scores for those documents. We demonstrate that the approximate solution obtained by NMU using Lagrangrian duality can lead to a better sum-of-parts representation and document classification accuracy.

show abstract