XML transactions are used in many information systems to store data and interact with other systems. Abnormal transactions, the result of either an on-going cyber attack or the actions of a benign user, can potentially harm the interacting systems and therefore they are regarded as a threat. In this paper we address the problem of anomaly detection and localization in XML transactions using machine learning techniques. We present a new XML anomaly detection framework, XML-AD. Within this framework, an automatic method for extracting features from XML transactions was developed as well as a practical method for transforming XML features into vectors of fixed dimensionality. With these two methods in place, the XML-AD framework makes it possible to utilize general learning algorithms for anomaly detection. Central to the functioning of the framework is a novel multi-univariate anomaly detection algorithm, ADIFA. The framework was evaluated on four XML transactions datasets, captured from real information systems, in which it achieved over 89 true positive detection rate with less than a 0.2 false positive rate.
Premalatha and Natarajan @cite_6 mine negative association rules @cite_23 , which are used to describe those relationships between item sets that indicate the occurrence of some item sets by the absence of others. The chi-square test is used to identify independent attributes and the anomalies are identified as a negative association rule whose confidence value is greater than a minimum confidence threshold. Unfortunately, domain knowledge of the data sets is incorporated into filter rules, a step that does not contribute to the detection process.
@cite_23 @cite_6
2026562765 2045006855
This paper presents an efficient method for mining both positive and negative association rules in databases. The method extends traditional associations to include association rules of forms A ⇒ ¬ B, ¬ A ⇒ B, and ¬ A ⇒ ¬ B, which indicate negative associations between itemsets. With a pruning strategy and an interestingness measure, our method scales to large databases. The method has been evaluated using both synthetic and real-world databases, and our experimental results demonstrate its effectiveness and efficiency. Anomaly detection is the double purpose of discovering interesting exceptions and identifying incorrect data in huge amounts of data. Since anomalies are rare events, which violate the frequent relationships among data. Normally anomaly detection builds models of normal behavior and automatically detects significant deviations from it. The proposed system detects the anomalies in nested XML documents by independency between data. The negative association rules and the chi-square test for independency are applied on the data and a model of abnormal behavior is built as a signature profile. This signature profile can be used to identify the anomalies in the system. The proposed system limits the unnecessary rules for detecting anomalies.