We present a method to detect anomalies in a time series of flow interaction patterns. There are many existing methods for anomaly detection in network traffic, such as number of packets. However, there is non established method detecting anomalies in a time series of flow interaction patterns that can be represented as complex network. Firstly, based on proposed multivariate flow similarity method on temporal locality, a complex network model (MFS-TL) is constructed to describe the interactive behaviors of traffic flows. Having analyzed the relationships between MFS-TL characteristics, temporal locality window and multivariate flow similarity critical threshold, an approach for parameter determination is established. Having observed the evolution of MFS-TL characteristics, three non-deterministic correlations are defined for network states (i.e. normal or abnormal). Furthermore, intuitionistic fuzzy set (IFS) is introduced to quantify three non-deterministic correlations, and then a anomaly detection method is put forward for single characteristic sequence. To build an objective IFS, we design a Gaussian distribution-based membership function with a variable hesitation degree. To determine the mapping of IFS's clustering intervals to network states, a distinction index is developed. Then, an IFS ensemble method (IFSE-AD) is proposed to eliminate the impacts of the inconsistent about MFS-TL characteristic to network state and improve detection performance. Finally, we carried out extensive experiments on several network traffic datasets for anomaly detection, and the results demonstrate the superiority of IFSE-AD to state-of-the-art approaches, validating the effectiveness of our method.
Network traffic anomalies are instances in data that do not conform to the behavior exhibited by normal traffic. Traffic anomalies in a network can be defined as any network events or operation that deviate from the normal network behavior. They happen due to the growing number of network-based attacks or intrusions. Nowadays, the network anomaly detection methods can be classified into the statistic-, classification-, clustering-, soft computing-, fuzzy set theory-, and combination learners-based @cite_21 @cite_42 . In general, the first step is that the raw data is reduced by one of the three important strategies, i.e. dimensionality reduction (e.g. feature selection and feature extraction), clustering, and sampling, on packet-level, flow-level or host-level. However, the selected features or quantified metrics are usually used as the individual indicator @cite_55 @cite_41 @cite_45 @cite_32 .
@cite_41 @cite_55 @cite_21 @cite_42 @cite_32 @cite_45
2790864385 2789514799 1966809779 2278186031 2802898945 2603600199
With the development of 5G and Internet of Vehicles technology, the possibility of remote wireless attack on an in-vehicle network has been proven by security researchers. Anomaly detection technology can effectively alleviate the security threat, as the first line of security defense. Based on this, this paper proposes a distributed anomaly detection system using hierarchical temporal memory (HTM) to enhance the security of a vehicular controller area network bus. The HTM model can predict the flow data in real time, which depends on the state of the previous learning. In addition, we improved the abnormal score mechanism to evaluate the prediction. We manually synthesized field modification and replay attack in data field. Compared with recurrent neural networks and hidden Markov model detection models, the results show that the distributed anomaly detection system based on HTM networks achieves better performance in the area under receiver operating characteristic curve score, precision, and recall. A reliable method to estimate viewer interest is highly sought after for human-centered video information retrieval. A method that estimates viewer interest while users are watching Web videos is presented in this paper. The method uses a framework for anomaly detection based on collaborative use of facial expression and biological signals such as electroencephalogram (EEG) signals. To the best of our knowledge, there have been no studies that have taken into account two actual mechanisms of the behavior of users while they are watching Web videos. First, whereas most Web videos garner very little attention, a small number attract millions of views. Therefore, a framework for anomaly detection is newly applied to facial expression and EEG in order to model the imbalanced distribution of popularity. Second, since the number of Web videos that are labeled by users as interesting not interesting is generally too small to estimate viewer interest by a supervised approach, the proposed method utilizes parametric techniques for anomaly detection, which estimates viewer interest in an unsupervised way. Unlike some related studies for estimating viewer interest, our method takes into account actual mechanisms of the behavior of users while they are watching Web videos by utilizing parametric techniques for anomaly detection. Then viewer interest can be estimated on the basis of an anomaly score calculated from our proposed method. Consequently, successful estimation of viewer interest based on a framework for anomaly detection, via collaborative use of facial expression and biological signals, becomes feasible. Network anomaly detection is an important and dynamic research area. Many network intrusion detection methods and systems (NIDS) have been proposed in the literature. In this paper, we provide a structured and comprehensive overview of various facets of network anomaly detection so that a researcher can become quickly familiar with every aspect of network anomaly detection. We present attacks normally encountered by network intrusion detection systems. We categorize existing network anomaly detection methods and systems based on the underlying computational techniques used. Within this framework, we briefly describe and compare a large number of network anomaly detection methods and systems. In addition, we also discuss tools that can be used by network defenders and datasets that researchers in network anomaly detection can use. We also highlight research directions in network anomaly detection. Information and Communication Technology (ICT) has a great impact on social wellbeing, economic growth and national security in todays world. Generally, ICT includes computers, mobile communication devices and networks. ICT is also embraced by a group of people with malicious intent, also known as network intruders, cyber criminals, etc. Confronting these detrimental cyber activities is one of the international priorities and important research area. Anomaly detection is an important data analysis task which is useful for identifying the network intrusions. This paper presents an in-depth analysis of four major categories of anomaly detection techniques which include classification, statistical, information theory and clustering. The paper also discusses research challenges with the datasets used for network intrusion detection. HighlightsMaps different types of anomalies with network attacks.Provides an up-to-date taxonomy of network anomaly detection.Evaluates effectiveness of different categories of techniques.Explores recent research related to publicly available network intrusion evaluation datasets. Anomaly detection in time series is a popular topic focusing on a variety of applications, which achieves a wealth of results. However, there are many cases of missing anomaly and increased false alarm in most of the existing works. Inspired by the concept of interval-sets, this paper proposes an anomaly detection algorithm called a fuzzy interval-set and tries to detect the potential value of the time series from a new perspective. In the proposed algorithm, a time series will be divided into several subsequences. Each subsequence is regarded as an interval-set depending on its value space and boundary of the subsequence. The similarity measurements between interval sets adopt interval operations and point probability distributions of the interval bounds. In addition, an anomaly score is defined based on similarity results. The experimental results on synthetic and real data sets indicate that the proposed algorithm has better discriminative performance than the piecewise aggregate approximation method and reduces the false alarm rate significantly. It proves to be increasingly promising to evaluate the network coverage and network capacity via applying data generated by network interaction provided by the mobile operators in recent years. Self-organized optimization of network coverage and network capacity is a key solution to cope with the rapid growth of mobile data services and user expectation. In this paper, a network performance anomaly detection model based on service feature clustering is proposed. First, the complexity of the wireless network environment and the difference of user behavior are fully considered, an ensemble clustering algorithm is adopted for scene classification by combining the features of various data services with multi-dimensional physical scene characteristics, and, then, the cell categories with different characteristics are marked. Second, each category matches the corresponding network indicators and the weights of each indicators, which are trained from historical data. Finally, network performance anomaly detection is conducted on the basis of these indicators in every scene so that a new approach to evaluate the performance of wireless network can be realized. We apply this method to our long term evolution network, and the actual operation results have confirmed that the algorithm in question is highly effective and relevant.