Entropy Measures for Stochastic Processes with Applications in Functional Anomaly Detection

Martos, Gabriel; Hernández, Nicolás; Muñoz, Alberto; Moguerza, Javier M.

doi:10.3390/e20010033

Cited by 10 publications

(10 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, we note that there exist similarities between the method presented here and in [23], but with significant differences. First, in the construction of the model, our paper proposes modifications to the EM algorithm in order to solve some of the main difficulties in the use of probabilistic models for outlier detection.…”

mentioning

confidence: 72%

“…However, the techniques can differ significantly between them. Many of them rely on the notion of statistical depth [9,21,22] or other measures (e.g., entropy [23]). In contrast, others rely on other dimensionality reduction methods, clustering, or hypothesis testing on the coefficients of some functional decomposition [24], as well as graphical tools [25].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Functional Outlier Detection by Means of h-Mode Depth and Dynamic Time Warping

Pinedo

Iooss²,

Couplet

et al. 2021

Applied Sciences

View full text Add to dashboard Cite

Finding outliers in functional infinite-dimensional vector spaces is widely present in the industry for data that may originate from physical measurements or numerical simulations. An automatic and unsupervised process of outlier identification can help ensure the quality of a dataset (trimming), validate the results of industrial simulation codes, or detect specific phenomena or anomalies. This paper focuses on data originating from expensive simulation codes to take into account the realistic case where only a limited quantity of information about the studied process is available. A detection methodology based on different features, such as h-mode depth or the dynamic time warping, is proposed to evaluate the outlyingness both in the magnitude and shape senses. Theoretical examples are used to identify pertinent feature combinations and showcase the quality of the detection method with respect to state-of-the-art methodologies of detection. Finally, we show the practical interest of the method in an industrial context thanks to a nuclear thermal-hydraulic use case and how it can serve as a tool to perform sensitivity analysis on functional data.

show abstract

mentioning

confidence: 72%

Section: Introductionmentioning

confidence: 99%

Functional Outlier Detection by Means of h-Mode Depth and Dynamic Time Warping

Pinedo

Iooss²,

Couplet

et al. 2021

Applied Sciences

View full text Add to dashboard Cite

show abstract

“…This paves the way to define the ∆-local entropy [13] corresponding to any subset ∆ P F Ω as follows…”

Section: Local Entropy Kernelsmentioning

confidence: 99%

Combining Entropy Measures for Anomaly Detection

Muñoz

Hernández

Moguerza

et al. 2018

Entropy

Self Cite

View full text Add to dashboard Cite

The combination of different sources of information is a problem that arises in several situations, for instance, when data are analysed using different similarity measures. Often, each source of information is given as a similarity, distance, or a kernel matrix. In this paper, we propose a new class of methods which consists of producing, for anomaly detection purposes, a single Mercer kernel (that acts as a similarity measure) from a set of local entropy kernels and, at the same time, avoids the task of model selection. This kernel is used to build an embedding of data in a variety that will allow the use of a (modified) one-class Support Vector Machine to detect outliers. We study several information combination schemes and their limiting behaviour when the data sample size increases within an Information Geometry context. In particular, we study the variety of the given positive definite kernel matrices to obtain the desired kernel combination as belonging to that variety. The proposed methodology has been evaluated on several real and artificial problems.

show abstract

“…As mentioned earlier, anomaly detection is intimately related to parameter estimation in probabilistic models, as, once a probabilistic model for the data is given, anomalous data can be detected if they deviate from the estimated model. Following [ 4 , 9 , 10 , 11 ], in [ 29 ], the authors considered representing a stochastic process while using the d -truncated Karhunen-Loève expansion. Clearly, this transformation can capture the memory in the data, as compared to single-letter measures.…”

Section: Introductionmentioning

confidence: 99%

Anomaly Detection for Individual Sequences with Applications in Identifying Malicious Tools

Siboni

Cohen

2020

Entropy

View full text Add to dashboard Cite

Anomaly detection refers to the problem of identifying abnormal behaviour within a set of measurements. In many cases, one has some statistical model for normal data, and wishes to identify whether new data fit the model or not. However, in others, while there are normal data to learn from, there is no statistical model for this data, and there is no structured parameter set to estimate. Thus, one is forced to assume an individual sequences setup, where there is no given model or any guarantee that such a model exists. In this work, we propose a universal anomaly detection algorithm for one-dimensional time series that is able to learn the normal behaviour of systems and alert for abnormalities, without assuming anything on the normal data, or anything on the anomalies. The suggested method utilizes new information measures that were derived from the Lempel–Ziv (LZ) compression algorithm in order to optimally and efficiently learn the normal behaviour (during learning), and then estimate the likelihood of new data (during operation) and classify it accordingly. We apply the algorithm to key problems in computer security, as well as a benchmark anomaly detection data set, all using simple, single-feature time-indexed data. The first is detecting Botnets Command and Control (C&C) channels without deep inspection. We then apply it to the problems of malicious tools detection via system calls monitoring and data leakage identification.We conclude with the New York City (NYC) taxi data. Finally, while using information theoretic tools, we show that an attacker’s attempt to maliciously fool the detection system by trying to generate normal data is bound to fail, either due to a high probability of error or because of the need for huge amounts of resources.

show abstract

Entropy Measures for Stochastic Processes with Applications in Functional Anomaly Detection

Cited by 10 publications

References 16 publications

Functional Outlier Detection by Means of h-Mode Depth and Dynamic Time Warping

Functional Outlier Detection by Means of h-Mode Depth and Dynamic Time Warping

Combining Entropy Measures for Anomaly Detection

Anomaly Detection for Individual Sequences with Applications in Identifying Malicious Tools

Contact Info

Product

Resources

About