Applications of Clustering Methods to Anomaly-Based Intrusion Detection Systems

Neycheva, Mariya; Jecheva, Veselina

doi:10.1109/dta.2015.19

Cited by 5 publications

(2 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…If it is not, then the work of the method is difficult. Using an inappropriate measure of proximity of objects affects the frequency of false alarms [28].…”

Section: Background On Network Anomaly Detection Methodsmentioning

confidence: 99%

A Software Deep Packet Inspection System for Network Traffic Analysis and Anomaly Detection

Song

Beshley

Przystupa

et al. 2020

Sensors

View full text Add to dashboard Cite

In this paper, to solve the problem of detecting network anomalies, a method of forming a set of informative features formalizing the normal and anomalous behavior of the system on the basis of evaluating the Hurst (H) parameter of the network traffic has been proposed. Criteria to detect and prevent various types of network anomalies using the Three Sigma Rule and Hurst parameter have been defined. A rescaled range (RS) method to evaluate the Hurst parameter has been chosen. The practical value of the proposed method is conditioned by a set of the following factors: low time spent on calculations, short time required for monitoring, the possibility of self-training, as well as the possibility of observing a wide range of traffic types. For new DPI (Deep Packet Inspection) system implementation, algorithms for analyzing and captured traffic with protocol detection and determining statistical load parameters have been developed. In addition, algorithms that are responsible for flow regulation to ensure the QoS (Quality of Services) based on the conducted static analysis of flows and the proposed method of detection of anomalies using the parameter Hurst have been developed. We compared the proposed software DPI system with the existing SolarWinds Deep Packet Inspection for the possibility of network traffic anomaly detection and prevention. The created software components of the proposed DPI system increase the efficiency of using standard intrusion detection and prevention systems by identifying and taking into account new non-standard factors and dependencies. The use of the developed system in the IoT communication infrastructure will increase the level of information security and significantly reduce the risks of its loss.

show abstract

“…If it is not, then the work of the method is difficult. Using an inappropriate measure of proximity of objects affects the frequency of false alarms [28].…”

Section: Background On Network Anomaly Detection Methodsmentioning

confidence: 99%

A Software Deep Packet Inspection System for Network Traffic Analysis and Anomaly Detection

Song

Beshley

Przystupa

et al. 2020

Sensors

View full text Add to dashboard Cite

show abstract

“…Typically, there is no prior knowledge to characterize an anomaly, nor ample data is available in any of the practical fields that symbolize these outliers [2]. A few examples of anomaly detection are the detection of rare (unusual) events in real life scenarios such as medical complications depicted in ECG/EEG data abnormalities [3], [4], [5], malfunctioning of rotary machines due to various physical factors [6], [7], security threat in cyberphysical systems [8], [9], [10], [11] or even fraud detection in financial systems [12].…”

Section: Introductionmentioning

confidence: 99%

ADIC: Anomaly Detection Integrated Circuit in 65nm CMOS utilizing Approximate Computing

Kar,

Gopalakrishnan,

Bose

et al. 2020

Preprint

View full text Add to dashboard Cite

In this paper, we present a low-power anomaly detection integrated circuit (ADIC) based on a one-class classifier (OCC) neural network. The ADIC achieves low-power operation through a combination of (a) careful choice of algorithm for online learning and (b) approximate computing techniques to lower average energy. In particular, online pseudoinverse update method (OPIUM) is used to train a randomized neural network for quick and resource efficient learning. An additional 42% energy saving can be achieved when a lighter version of OPIUM method is used for training with the same number of data samples lead to no significant compromise on the quality of inference.Instead of a single classifier with large number of neurons, an ensemble of K base learner approach is chosen to reduce learning memory by a factor of K. This also enables approximate computing by dynamically varying the neural network size based on anomaly detection. Fabricated in 65nm CMOS, the ADIC has K = 7 Base Learners (BL) with 32 neurons in each BL and dissipates 11.87pJ/OP and 3.35pJ/OP during learning and inference respectively at V dd = 0.75V when all 7 BLs are enabled. Further, evaluated on the NASA bearing dataset, approximately 80% of the chip can be shut down for 99% of the lifetime leading to an energy efficiency of 0.48pJ/OP , an 18.5 times reduction over full-precision computing running at V dd = 1.2V throughout the lifetime.

show abstract