Data Fusion for Outlier Detection through Pseudo-ROC Curves and Rank Distributions

Evangelista, Paul; Embrechts, Mark J.; Szymański, Bolesław K.

doi:10.1109/ijcnn.2006.246989

Cited by 4 publications

(2 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is not the case in our engine due to detectors specialized to some attacks. For such systems Evangelista [31] suggested to use average of mean and maximum scores of detectors within the ensemble, as it should be more robust to presence poor detectors without knowing which ones are poor. This combination function (further called Evangelista's) favors the highest anomaly scores and reduces the effect of poor detectors.…”

Section: Netflow Anomaly Detectionmentioning

confidence: 99%

Reducing false positives of network anomaly detection by local adaptive multivariate smoothing

Grill

Pevný

Řehák

2017

Journal of Computer and System Sciences

View full text Add to dashboard Cite

Section: Netflow Anomaly Detectionmentioning

confidence: 99%

Reducing false positives of network anomaly detection by local adaptive multivariate smoothing

Grill

Pevný

Řehák

2017

Journal of Computer and System Sciences

View full text Add to dashboard Cite

“…3) Aggregation and Anomaly Decision: Once the normalized anomaly metric n t i,j is output by the normalization module for all algorithms, j, for a particular subset S i , the aggregation module uses the aggregation function G to determine the final aggregated anomaly metric g t i across all a algorithms for subset i at time t. Some of the functions explored were arithmetic mean, geometric mean, median, minimum, and maximum. Evangelista et al [19] proposed the average of mean and minimum as an aggregation function. However, for our purpose, the average of mean and maximum has proven to be most effective:…”

Section: B Aggregation Of Anomaly Detection Algorithmsmentioning

confidence: 99%

A Taxonomy and Comparative Evaluation of Algorithms for Parallel Anomaly Detection

Shanbhag

Gu²,

Wolf

2010

2010 Proceedings of 19th International Conference on Computer Communications and Networks

View full text Add to dashboard Cite

Anomaly detection in network traffic is an important technique for identifying operation and security problems in networks. Numerous anomaly detection algorithms have been proposed and deployed in practice. The recent availability of high-performance embedded processors in network systems has made it possible to implement these algorithms to monitor traffic in real-time. Since it is unlikely that any single anomaly detection technique will ever be sufficient, we propose the use of multiple existing anomaly detection algorithms in parallel. In this paper, we develop a method of combining different classes of anomaly detection algorithms and address the question of which combination of existing anomaly detection algorithms achieves the best detection accuracy. We also present a taxonomy of anomaly detection algorithms and evaluate six specific algorithms on a common evaluation platform. Based on this evaluation, we identify the combination of anomaly detection algorithms that achieve the highest detection accuracy and derive a few rules that can be used when deciding on combining and aggregating multiple algorithms.

show abstract

Massively Parallel Anomaly Detection in Online Network Measurement

Shanbhag

Wolf

2008

2008 Proceedings of 17th International Conference on Computer Communications and Networks

View full text Add to dashboard Cite

Detecting anomalies during the operation of a network is an important aspect of network management and security. Recent development of high-performance embedded processing systems allow traffic monitoring and anomaly detection in real-time. In this paper, we show how such processing capabilities can be used to run several different anomaly detection algorithms in parallel on thousands of different traffic subclasses. The main challenge in this context is to manage and aggregate the vast amount of data generated by these processes. We propose (1) a novel aggregation process that uses continuous anomaly information (rather than binary outputs) from existing algorithms and (2) an anomaly tree representation to illustrate the state of all traffic subclasses. Aggregated anomaly detection results show a lower false positive and false negative rate than any single anomaly detection algorithm.

show abstract

Data Fusion for Outlier Detection through Pseudo-ROC Curves and Rank Distributions

Cited by 4 publications

References 20 publications

Reducing false positives of network anomaly detection by local adaptive multivariate smoothing

Reducing false positives of network anomaly detection by local adaptive multivariate smoothing

A Taxonomy and Comparative Evaluation of Algorithms for Parallel Anomaly Detection

Massively Parallel Anomaly Detection in Online Network Measurement

Contact Info

Product

Resources

About