Evaluation of Anomaly Detection Based on Sketch and PCA

Kanda, Yoshiki; Fukuda, Kensuke; Sugawara, Toshiharu

doi:10.1109/glocom.2010.5683878

Cited by 22 publications

(22 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In Ref. [16], Yoshiki Kanda et al proposed a new method that combines sketches and PCA to detect and identify the source IP addresses associated with the traffic anomalies in the backbone traces measured at a single link. At the same time, this algorithm has been used in worm signatures detection, such as Ref.…”

Section: Related Workmentioning

confidence: 99%

“…Then we calculate the sum of the amplitudes represented by the bit with value 1 during a continuous time window or time bin of the same size, and use the set of amplitude values obtained to construct a matrix. After that, we use Principal Component Analysis (PCA) technology [8][9] to analyse this highdimension matrix and get the main component to reconstruct the original data. At the end, the average of all the rebuilt application streams is considered as the signature of this application.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Network traffic signature generation mechanism using principal component analysis

Huang

2013

China Commun.

View full text Add to dashboard Cite

The Deep Packet Inspection (DPI) method is a popular method that can accurately identify the flow data and its corresponding application. Currently, the DPI method is widely used in common network management systems. However, the major limitation of DPI systems is that their signature library is mainly extracted manually, which makes it hard to efficiently obtain the signature of new applications. Hence, in this paper, we propose an automatic signature extraction mechanism using Principal Component Analysis (PCA) technology, which is able to extract the signature automatically. In the proposed method, the signatures are expressed in the form of serial consistent sequences constructed by principal components instead of normally separated substrings in the original data extracted from the traditional methods. Extensive experiments based on numerous sets of data have been carried out to evaluate the performance of the proposed scheme, and the results prove that the newly proposed method can achieve good performance in terms of accuracy and efficiency.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Network traffic signature generation mechanism using principal component analysis

Huang

2013

China Commun.

View full text Add to dashboard Cite

show abstract

“…In [3], after splitting the source IP address into keys, it was further split by applying another hash function to the split data, and then Principal Component Analysis (PCA) was applied to detect traffic anomalies. In this case, eight different hash functions, with a hash table size of 1024, were used as sketch parameters.…”

Section: Overview Of the Sketch Schemesmentioning

confidence: 99%

“…Previous studies concerning sketch schemes did not clarify the impact of sketch parameters on the anomaly detection performance [2,3]. Thus, our research aimed to evaluate the processing time and traffic anomaly detection accuracy using a sketch as a function of two sketch parameters: the number of hash functions and hash table size.…”

Section: Introductionmentioning

confidence: 99%

Performance evaluation of sketch schemes on traffic anomaly detection accuracy

2017

View full text Add to dashboard Cite

Network monitoring for high-speed networks shared by an increasing amount of traffic has become a crucial issue. Especially, traffic anomaly detection technology for high-speed networks is one of the most important issues, because of the increasingly serious nature of cyber-attacks such as worms, port scans, and DDoS. This study focuses on the use of sketch schemes as data reduction methods for traffic anomaly detection. Previous studies on sketch schemes neglected to fully clarify the impact of the sketch parameters on the anomaly detection performance. This study verified the processing time and traffic anomaly detection accuracy with a sketch as a function of two sketch parameters: the number of hash functions and hash table size. The range of the two sketch parameters was clarified by determining the processing time and F-measure, which evaluates both the false positive and false negative rates.

show abstract

“…In [7], OLIN, an online classification system, dynamically adjusts The recent research literature has proposed more tractable techniques for anomaly detection and classification [8,9,10,11]. These proposals rely on a common approach to data analysis: they apply dimensionality reduction techniques such as sketches [12,3] or principal components [13,14] to the aggregate network traffic.…”

Section: State Of the Artmentioning

confidence: 99%