Infrequent Pattern Detection for Reliable Network Traffic Analysis Using Robust Evolutionary Computation

Abstract

While anomaly detection is very important in many domains, such as in cybersecurity, there are many rare anomalies or infrequent patterns in cybersecurity datasets. Detection of infrequent patterns is computationally expensive. Cybersecurity datasets consist of many features, mostly irrelevant, resulting in lower classification performance by machine learning algorithms. Hence, a feature selection (FS) approach, i.e., selecting relevant features only, is an essential preprocessing step in cybersecurity data analysis. Despite many FS approaches proposed in the literature, cooperative co-evolution (CC)-based FS approaches can be more suitable for cybersecurity data preprocessing considering the Big Data scenario. Accordingly, in this paper, we have applied our previously proposed CC-based FS with random feature grouping (CCFSRFG) to a benchmark cybersecurity dataset as the preprocessing step. The dataset with original features and the dataset with a reduced number of features were used for infrequent pattern detection. Experimental analysis was performed and evaluated using 10 unsupervised anomaly detection techniques. Therefore, the proposed infrequent pattern detection is termed Unsupervised Infrequent Pattern Detection (UIPD). Then, we compared the experimental results with and without FS in terms of true positive rate (TPR). Experimental analysis indicates that the highest rate of TPR improvement was by cluster-based local outlier factor (CBLOF) of the backdoor infrequent pattern detection, and it was 385.91% when using FS. Furthermore, the highest overall infrequent pattern detection TPR was improved by 61.47% for all infrequent patterns using clustering-based multivariate Gaussian outlier score (CMGOS) with FS.

Anomaly Detection with Gradient Boosting Regressor on HVAC Systems

“…Another approach is to utilize Bayesian networks for scalable anomaly detection, where anomalies can arise from malicious cyber-attacks and operational faults [11]. Rashid et al discussed the concept of anomaly detection as identifying data patterns that deviate from expected behavior [12]. Jadidi et al proposed a comprehensive system-wide anomaly detection approach that utilized deep neural networks to identify anomalies and correlation analysis to investigate cyber-attacks impact interconnected devices in industrial control systems [13].…”