Machine learning-based run-time anomaly detection in software systems: An industrial evaluation

Huch, Fabian; Golagha, Mojdeh; Petrovska, Ana; Krauß, Alexander

doi:10.1109/maltesque.2018.8368453

Cited by 13 publications

(8 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Added to the originality to the proposed learning method compared to other machine learning methods, it is giving very high accuracy in general. In [1], even not applied with our same tested programs, the learning-based run-time anomaly detection in software systems detects 70% of anomalies. We could not observe a code or data change if it does not contaminate the state of the program.…”

Section: Validation Of the Methods And Its Limitmentioning

confidence: 97%

“…This might be explained logically as well: in fact, pattern (1-2) reflects a swapping of two elements in the trace 1 giving trace 2. Pattern (2-3) reflects a swapping of two elements in the trace 2 giving 3, then pattern (1,3) represents the two consecutive swaps. Together patterns (1)(2) and (2)(3) represent the concept corresponding to (1,3) because it included all "1"s in (1-2) and (2-3) only.…”

Section: ) Detecting Anomaliesmentioning

confidence: 99%

“…During the last two decades, several researchers have built anomaly detection methods based on feature definition of the system parameters from which they learn how to recognize inconsistent or unstable states [1] [2]. On one hand, most empirical machine learning methods are able to provide limited accuracy in these methods.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Anomalies Detection in Software by Conceptual Learning From Normal Executions

et al. 2020

View full text Add to dashboard Cite

Could we detect anomalies during the run-time of a program by learning from the analysis of its previous traces for normally completed executions? In this paper we create a featured data set from program traces at run time, either during its regular life, or during its testing phase. This data set represents execution traces of relevant variables including inputs, outputs, intermediate variables, and invariant checks. During a learning mining step, we start from exhaustive random training input sets and map program traces to a minimal set of conceptual patterns. We employ formal concept analysis to do this in an incremental way, and without losing dependencies between data set features. This set of patterns becomes a reference for checking the normality of future program executions as it captures invariant functional dependencies between the variables that need to be preserved during execution. During the learning step, we consider enough input classes corresponding to the different patterns by using random input selection until reaching stability of the set of patterns (i.e. the set is almost no longer changing, and only negligible new patterns are not reducible to it). Experimental results show that the generated patterns are significant in representing normal program executions. They also enable the detection of different executable code contamination at early stages. The proposed method is general and modular. If applied systematically, it enhances software resilience against abnormal and unpredictable events.

show abstract

Section: Validation Of the Methods And Its Limitmentioning

confidence: 97%

Section: ) Detecting Anomaliesmentioning

confidence: 99%

See 1 more Smart Citation

Anomalies Detection in Software by Conceptual Learning From Normal Executions

et al. 2020

View full text Add to dashboard Cite

show abstract

“…The artificial neural network was used to train our network and get the results. Mitrokotsa et al (2007) Huch et al (2018) present a machine learning based anomaly behaviour detection mechanism to predict a system's health. This research proves that regular neural networks with long short-term memory (LSTM) are more effective in sensing irregularities than other classifiers.…”

Section: Intrusion Detection Using Neural Network In Healthcarementioning

confidence: 99%

Security as a Solution: An Intrusion Detection System Using a Neural Network for IoT Enabled Healthcare Ecosystem

Jain¹,

Singh²,

Sharma

2021

IJIKM

View full text Add to dashboard Cite

Aim/Purpose: The primary purpose of this study is to provide a cost-effective and artificial intelligence enabled security solution for IoT enabled healthcare ecosystem. It helps to implement, improve, and add new attributes to healthcare services. The paper aims to develop a method based on an artificial neural network technique to predict suspicious devices based on bandwidth usage. Background: COVID has made it mandatory to make medical services available online to every remote place. However, services in the healthcare ecosystem require fast, uninterrupted facilities while securing the data flowing through them. The solution in this paper addresses both the security and uninterrupted services issue. This paper proposes a neural network based solution to detect and disable suspicious devices without interrupting critical and life-saving services. Methodology: This paper is an advancement on our previous research, where we performed manual knowledge-based intrusion detection. In this research, all the experiments were executed in the healthcare domain. The mobility pattern of the devices was divided into six parts, and each one is assigned a dedicated slice. The security module regularly monitored all the clients connected to slices, and machine learning was used to detect and disable the problematic or suspicious devices. We have used MATLAB’s neural network to train the dataset and automatically detect and disable suspicious devices. The different network architectures and different training algorithms (Levenberg–Marquardt and Bayesian Framework) in MATLAB software have attempted to achieve more precise values with different properties. Five iterations of training were executed and compared to get the best result of R=99971. We configured the application to handle the four most applicable use cases. We also performed an experimental application simulation for the assessment and validation of predictions. Contribution: This paper provides a security solution for the IoT enabled healthcare system. The architectures discussed suggest an end-to-end solution on the sliced network. Efficient use of artificial neural networks detects and block suspicious devices. Moreover, the solution can be modified, configured and deployed in many other ecosystems like home automation. Findings: This simulation is a subset of the more extensive simulation previously performed on the sliced network to enhance its security. This paper trained the data using a neural network to make the application intelligent and robust. This enhancement helps detect suspicious devices and isolate them before any harm is caused on the network. The solution works both for an intrusion detection and prevention system by detecting and blocking them from using network resources. The result concludes that using multiple hidden layers and a non-linear transfer function, logsig improved the learning and results. Recommendations for Practitioners: Everything from offices, schools, colleges, and e-consultation is currently happening remotely. It has caused extensive pressure on the network where the data flowing through it has increased multifold. Therefore, it becomes our joint responsibility to provide a cost-effective and sustainable security solution for IoT enabled healthcare services. Practitioners can efficiently use this affordable solution compared to the expensive security options available in the commercial market and deploy it over a sliced network. The solution can be implemented by NGOs and federal governments to provide secure and affordable healthcare monitoring services to patients in remote locations. Recommendation for Researchers: Research can take this solution to the next level by integrating artificial intelligence into all the modules. They can augment this solution by making it compatible with the federal government’s data privacy laws. Authentication and encryption modules can be integrated to enhance it further. Impact on Society: COVID has given massive exposure to the healthcare sector since last year. With everything online, data security and privacy is the next most significant concern. This research can be of great support to those working for the security of health care services. This paper provides “Security as a Solution”, which can enhance the security of an otherwise less secure ecosystem. The healthcare use cases discussed in this paper address the most common security issues in the IoT enabled healthcare ecosystem. Future Research: We can enhance this application by including data privacy modules like authentication and authorisation, data encryption and help to abide by the federal privacy laws. In addition, machine learning and artificial intelligence can be extended to other modules of this application. Moreover, this experiment can be easily applicable to many other domains like e-homes, e-offices and many others. For example, e-homes can have devices like kitchen equipment, rooms, dining, cars, bicycles, and smartwatches. Therefore, one can use this application to monitor these devices and detect any suspicious activity.

show abstract

“…Enterprise software system anomalies: This dataset was collected between August 2014 and October 2015 by Huch et al [43] in a real-world industrial setting-monitoring 20 instances of a complex enterprise application-to test the feasibility of machine learning-based anomaly detection at runtime. The dataset consists of 831 metrics in 1-minute time intervals (in total 7.5 × 10 6 data points), and contains time series data about the operating system, database connections and transactions, memory and CPU usage and many other metrics.…”

mentioning

confidence: 99%

Resource Usage and Performance Trade-offs for Machine Learning Models in Smart Environments

Preuveneers

Tsingenopoulos

Joosen

2020

Sensors

View full text Add to dashboard Cite

The application of artificial intelligence enhances the ability of sensor and networking technologies to realize smart systems that sense, monitor and automatically control our everyday environments. Intelligent systems and applications often automate decisions based on the outcome of certain machine learning models. They collaborate at an ever increasing scale, ranging from smart homes and smart factories to smart cities. The best performing machine learning model, its architecture and parameters for a given task are ideally automatically determined through a hyperparameter tuning process. At the same time, edge computing is an emerging distributed computing paradigm that aims to bring computation and data storage closer to the location where they are needed to save network bandwidth or reduce the latency of requests. The challenge we address in this work is that hyperparameter tuning does not take into consideration resource trade-offs when selecting the best model for deployment in smart environments. The most accurate model might be prohibitively expensive to computationally evaluate on a resource constrained node at the edge of the network. We propose a multi-objective optimization solution to find acceptable trade-offs between model accuracy and resource consumption to enable the deployment of machine learning models in resource constrained smart environments. We demonstrate the feasibility of our approach by means of an anomaly detection use case. Additionally, we evaluate the extent that transfer learning techniques can be applied to reduce the amount of training required by reusing previous models, parameters and trade-off points from similar settings.

show abstract

Machine learning-based run-time anomaly detection in software systems: An industrial evaluation

Cited by 13 publications

References 16 publications

Anomalies Detection in Software by Conceptual Learning From Normal Executions

Anomalies Detection in Software by Conceptual Learning From Normal Executions

Security as a Solution: An Intrusion Detection System Using a Neural Network for IoT Enabled Healthcare Ecosystem

Resource Usage and Performance Trade-offs for Machine Learning Models in Smart Environments

Contact Info

Product

Resources

About