Catch It If You Can: Real-Time Network Anomaly Detection with Low False Alarm Rates

Kathareios, Georgios; Anghel, Andreea; Mate, Akos; Clauberg, R.; Gusat, Mitch

doi:10.1109/icmla.2017.00-36

Cited by 29 publications

(30 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[8][9][10] Although the results of these detection approaches have indicated high accuracies, there are still some aspects of the methods and their evaluations, which should be improved. 14,15 In this paper, to tackle the mentioned challenges, we develop a dynamic botnet detection system with the selflearning capability. However, such data sets are infrequent in previous research.…”

Section: Introductionmentioning

confidence: 99%

“…First, evaluation should be performed with a comprehensive data set, which covers benign traffic as well as malicious traffic generated by a variety of botnets. 15,16 A set of conditions control the model update procedure to achieve a high detection rate while saving the storage capacity. 11 Besides, if training and test data overlap, the measured detection rates cannot be generalized to the real world situations.…”

Section: Introductionmentioning

confidence: 99%

“…Such a system can adapt to the dynamic nature of the Internet. 14,15 In this paper, to tackle the mentioned challenges, we develop a dynamic botnet detection system with the selflearning capability. We use an ensemble of nonparametric classifiers initialized using a small set of labeled training data.…”

Section: Introductionmentioning

confidence: 99%

“…This is in particular different from online learning where information on real labels of new instances is necessary. 15,16 A set of conditions control the model update procedure to achieve a high detection rate while saving the storage capacity. Incremental learning with new previously unseen instances increases the generalizability of the detection system and adapts the model to the evolution of real network traffic.…”

Section: Introductionmentioning

confidence: 99%

“…To the best of our knowledge, our study is the first self-learning incremental botnet detection system, which applies such a large comprehensive and diverse data set. We compare the performance of the proposed approach against nonincremental methods (including 11 ), and two state of the art semisupervised detection algorithms ( 14,15 ). The results show that the system is capable of initiating with a small labeled dataset, learning from unlabeled flows, and detecting unknown types of botnets.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

A self‐learning stream classifier for flow‐based botnet detection

Gelian

Mashayekhi

2019

Int J Communication

View full text Add to dashboard Cite

Botnets have been recently recognized as one of the most formidable threats on the Internet. Different approaches have been designed to detect these types of attacks. However, as botnets evolve their behavior to mislead the signaturebased detection systems, learning-based methods may be deployed to provide a generalization capacity in identifying unknown botnets. Developing an adaptable botnet detection system, which incrementally evolves with the incoming flow stream, remains as a challenge. In this paper, a self-learning botnet detection system is proposed, which uses an adaptable classification model. The system uses an ensemble classifier and, in order to enhance its generalization capacity, updates its model continuously on receiving new unlabeled traffic flows. The system is evaluated with a comprehensive data set, which contains a wide variety of botnets. The experiments demonstrate that the proposed system can successfully adapt in a dynamic environment where new botnet types are observed during the system operation. We also compare the system performance with other methods.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A self‐learning stream classifier for flow‐based botnet detection

Gelian

Mashayekhi

2019

Int J Communication

View full text Add to dashboard Cite

show abstract

GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN

Wakui¹,

Kondo²,

Teraoka³

2020

Machine Learning for Networking

View full text Add to dashboard Cite

This paper proposes a general-purpose anomaly detection mechanism for Internet backbone traffic named GAMPAL (Generalpurpose Anomaly detection Mechanism using Path Aggregate without Labeled data). GAMPAL does not require labeled data to achieve a generalpurpose anomaly detection. For scalability to the number of entries in the BGP RIB (Routing Information Base), GAMPAL introduces path aggregates. The BGP RIB entries are classified into the path aggregates, each of which is identified with the first three AS numbers in the AS PATH attribute. GAMPAL establishes a prediction model of traffic throughput based on past traffic throughput. It adopts the LSTM-RNN (Long Short-Term Memory Recurrent Neural Network) model focusing on periodicity in weekly scale of the Internet traffic pattern. The validity of GAMPAL is evaluated using the real traffic information and the BGP RIB exported from the WIDE backbone network (AS2500), a nation-wide backbone network for research and educational organizations in Japan. As a result, GAMPAL successfully detects traffic increases due to events and DDoS attacks targeted to a stub organization.

show abstract

Big Data in Network Anomaly Detection

Le¹,

Zincir-Heywood²

2012

Encyclopedia of Big Data Technologies

View full text Add to dashboard Cite

Catch It If You Can: Real-Time Network Anomaly Detection with Low False Alarm Rates

Cited by 29 publications

References 13 publications

A self‐learning stream classifier for flow‐based botnet detection

A self‐learning stream classifier for flow‐based botnet detection

GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN

Big Data in Network Anomaly Detection

Contact Info

Product

Resources

About