Cyber-Typhon: An Online Multi-task Anomaly Detection Framework

Demertzis, Konstantinos; Iliadis, Lazaros; Kikiras, Panayiotis; Tziritas, Nikos

doi:10.1007/978-3-030-19823-7_2

Cited by 5 publications

(2 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Learning Machine (OS-ELM) with a set of Restricted Boltzmann machine (RBM) to classify network flows into several classes of attacks [Demertzis et al, 2019]. It also used the public dataset of a Gas pipeline [Morris and Gao, 2014] but does not specify whether the entire feature space is used or not, only mentioning that the data is grouped into sliding windows of 100 samples with overlapping of 400 instances.…”

Section: Intrusion and Anomaly Detection Techniques For Iacsmentioning

confidence: 99%

Intrusion and Anomaly Detection in Industrial Automation and Control Systems

Rosa

Cruz

Simões

et al. 2023

NOMS 2023-2023 IEEE/IFIP Network Operations and Management Symposium

View full text Add to dashboard Cite

The completion of my dissertation would not have been possible without the valuable discussions and all the constructive criticism they provided me. In that sense, first, I would like to extend my deepest gratitude to my formal supervisors. Paulo Simões, with his experience and unique way to look at things, always encouraged me on this journey.Invariably, he gave the peace of mind I needed. Then, Edmundo Monteiro whose help and patience cannot be overestimated. In my long journey with ups and downs, whenever I requested, he had a word for me. And last but not least, I would like to express my sincere gratitude to Tiago Cruz. For the careful reader, Tiago does not appear in the first pages as my official supervisor. Nevertheless, after starting this dissertation, I was lucky enough to meet him. Since then, in the last years, I have been working closely with him and we became friends, he was always there to support me and listen to my endless complaints.More, he was kind enough to provide me his expertise and guidance as my supervisor and discuss all the technical details of this dissertation. For all of those reasons, I will always consider him one of my supervisors.Next, without getting into details to avoid being unfair, I would like to thank my friends and colleagues who really worked with me for the past years and made this journey less lonely.We called ourselves the G54 team. This was a group of young and committed researchers who developed strong relationships way beyond the normal working environment. They consistently offered their help, technical support, and push me to complete my dissertation.I'm a proud member of the G54 spirit. Likewise, I would like to extend my sincere thanks to the LCT research group which I'm also proud to be part of. Their continuous support and all the pleasant moments we get together are truly priceless.Finally, I'm deeply indebted to my family, and in particular to my wife, for the full support, motivation, love, and patience.

show abstract

Section: Intrusion and Anomaly Detection Techniques For Iacsmentioning

confidence: 99%

Intrusion and Anomaly Detection in Industrial Automation and Control Systems

Rosa

Cruz

Simões

et al. 2023

NOMS 2023-2023 IEEE/IFIP Network Operations and Management Symposium

View full text Add to dashboard Cite

show abstract

“…In 2018, Huang et al [26] proposed a novel multi-task learning system based on convolutional neural network, which can simultaneously solve the tasks of malware detection, VPN-capsulation recognition and Trojan classification. Besides, Demertzis et al [27] proposed an Online MultiTask Anomaly Detection Framework -Cyber-Typhon (CYTY), which aims to fully upgrade old passive infrastructure through an intelligent mechanism using advanced Computational Intelligence (COIN) algorithms. Unfortunately, as shown in the Table 1, the training of these models still depend on the huge training set and do not consider the scenario of limited attack data.…”

Section: B Multi-task Learningmentioning

confidence: 99%

The Effective Methods for Intrusion Detection With Limited Network Attack Data: Multi-Task Learning and Oversampling

et al. 2020

View full text Add to dashboard Cite

Recently, many anomaly intrusion detection algorithms have been developed and applied in network security. These algorithms achieve high detection rate on many classical datasets. However, most of them failed to address two challenges: 1) imbalanced traffic data with limited network attack, 2) multiple data sources that are distributed in different terminals. In detail, those algorithms assume that there are sufficient network traffic data to train their models for intrusion detection. Due to the network attack traffic is always scarce in the real-world network, this assumption is difficult to satisfy in most cases. In this paper, we use Multi-Task Learning (MTL) and oversampling methods to address those challenges of network intrusion detection. Firstly, we use the MTL method to treat each terminal as a single task, and then use relevant information between different terminals to help learn every single task. Meanwhile, we use the oversampling method to overcome the minority problem of attacks. Through a series of experiments on the latest UNSW-NB15 and CICIDS2018 datasets, this paper verifies the effectiveness of MTL and oversampling methods for network intrusion detection with limited network attack data, where they achieve more than 90% detection rate in different experimental settings.

show abstract