Dynamic model selection with its applications to computer security

Maruyama, Y.; Yamanishi, Kenji

doi:10.1109/itw.2004.1405279

Cited by 4 publications

(9 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This makes the model adaptive to the non-stationary environment. III) The optimal number of mixture components in the HMM mixture is dynamically selected on the basis of the theory of dynamic model selection (see [10]). IV) An anomaly score is calculated for a series of messages on the basis of universal test statistics and an alert is raised when the anomaly score exceeds a threshold, which is dynamically optimized over time.…”

Section: Problem Settingmentioning

confidence: 99%

“…We reduce here this issue to that of dynamically selecting the optimal number of components for an HMM mixture and tracking its change. We realize this function on the basis of the theory of dynamic model selection (for short, DMS) [10].…”

Section: Dynamic Model Selectionmentioning

confidence: 99%

“…According to [10], DMS is classified into two types: Sequential DMS and batch DMS. The former sequentially outputs the optimal number of mixture components everytime a session is input.…”

Section: Dynamic Model Selectionmentioning

confidence: 99%

“…Batch DMS works better than sequential DMS in the sense that the value of criterion (4) for batch DMS tends to be smaller than the total code-length for sequential DMS (see [10]). Meanwhile, sequential DMS can process a session stream in an on-line manner while batch DMS processes it in a retrospective manner only.…”

Section: Batch Dynamic Model Selectionmentioning

confidence: 99%

“…where 0 < α < 1 is unknown and Kmax is the maximum value of K. We employ the batch DMS algorithm proposed in [10] for efficiently computing the model sequence minimizing the criterion (4). The details are shown in Figure 3.…”

Section: Batch Dynamic Model Selectionmentioning

confidence: 99%

See 4 more Smart Citations

Dynamic syslog mining for network failure monitoring

Yamanishi

Maruyama

2005

Proceedings of the Eleventh ACM SIGKDD International Conference on Knowledge Discovery in Data Mining

169

View full text Add to dashboard Cite

Syslog monitoring technologies have recently received vast attentions in the areas of network management and network monitoring. They are used to address a wide range of important issues including network failure symptom detection and event correlation discovery. Syslogs are intrinsically dynamic in the sense that they form a time series and that their behavior may change over time. This paper proposes a new methodology of dynamic syslog mining in order to detect failure symptoms with higher confidence and to discover sequential alarm patterns among computer devices.The key ideas of dynamic syslog mining are 1) to represent syslog behavior using a mixture of Hidden Markov Models, 2) to adaptively learn the model using an on-line discounting learning algorithm in combination with dynamic selection of the optimal number of mixture components, and 3) to give anomaly scores using universal test statistics with a dynamically optimized threshold. Using real syslog data we demonstrate the validity of our methodology in the scenarios of failure symptom detection, emerging pattern identification, and correlation discovery.

show abstract

Section: Problem Settingmentioning

confidence: 99%

Section: Dynamic Model Selectionmentioning

confidence: 99%

“…According to [10], DMS is classified into two types: Sequential DMS and batch DMS. The former sequentially outputs the optimal number of mixture components everytime a session is input.…”

Section: Dynamic Model Selectionmentioning

confidence: 99%

Section: Batch Dynamic Model Selectionmentioning

confidence: 99%

Section: Batch Dynamic Model Selectionmentioning

confidence: 99%

See 3 more Smart Citations

Dynamic syslog mining for network failure monitoring

Yamanishi

Maruyama

2005

Proceedings of the Eleventh ACM SIGKDD International Conference on Knowledge Discovery in Data Mining

169

View full text Add to dashboard Cite

show abstract

dLSTM: a new approach for anomaly detection using deep learning with delayed prediction

Maya

Ueno

Nishikawa

2019

Int J Data Sci Anal

View full text Add to dashboard Cite

In this paper, we propose delayed Long Short-Term Memory (dLSTM), an anomaly detection method for time-series data. We first build a predictive model from normal (non-anomalous) training data, then perform anomaly detection based on the prediction error for observed data. However, there are multiple states in the waveforms of normal data, which may lower prediction accuracy. To deal with this problem, we utilize multiple prediction models based on LSTM for anomaly detection. In this scheme, the prediction accuracy strongly depends on the method of selecting a proper predictive model from multiple possible models. We propose a novel method to determine the proper predictive model for anomaly detection. Our approach provides multiple predicted value candidates in advance and selects the one that is closest to the measured value. We delay the model selection until the corresponding measured values are acquired. Using this concept for anomaly detection, dLSTM selects the proper predictive model to enhance prediction accuracy. In our experimental evaluation using real and artificial data, dLSTM detects anomalies more accurately than methods in comparison.

show abstract

Anomaly detection based on hybrid artificial immune principles

Sobh

2013

Information Management &Amp; Computer Security

View full text Add to dashboard Cite

Purpose – Anomaly detection of network attacks has become a high priority because of the need to guarantee security, privacy and reliability. This work aims to describe both intelligent immunological approaches and traditional monitoring systems for anomaly detection. Design/methodology/approach – Author investigated different artificial immune system (AIS) theories and proposes how to combine different ideas to solve problems of network security domain. An anomaly detection system that applies those ideas was built and tested in a real time environment, to test the pros and cons of AIS and clarify its applicability. Rather than building a detailed signature based model of intrusion detection system, the scope of this study tries to explore the principle in an immune network focusing on its self-organization, adaptive learning capability, and immune feedback. Findings – The natural immune system has its own intelligent mechanisms to detect the foreign bodies and fight them and without it, an individual cannot live, even just for several days. Network attackers evolved new types of attacks. Attacks became more complex, severe and hard to detect. This results in increasing needs for network defense systems, especially those with ability to extraordinary approaches or to face the dynamic nature of continuously changing network threats. KDD CUP'99 dataset are used as a training data to evaluate the proposed hybrid artificial immune principles anomaly detection. The average cost of the proposed model was 0.1195 where that the wining of KDD99 dataset computation had 0.233. Originality/value – It is original to introduce investigation on the vaccination biological process. A special module was built to perform this process and check its usage and how it could be formulated in artificial life.

show abstract

Dynamic model selection with its applications to computer security

Cited by 4 publications

References 19 publications

Dynamic syslog mining for network failure monitoring

Dynamic syslog mining for network failure monitoring

dLSTM: a new approach for anomaly detection using deep learning with delayed prediction

Anomaly detection based on hybrid artificial immune principles

Contact Info

Product

Resources

About