A New Unsupervised Anomaly Detection Framework for Detecting Network Attacks in Real-Time

Author(s):  
Wei Lu ◽  
Issa Traore
Symmetry ◽  
2020 ◽  
Vol 12 (8) ◽  
pp. 1251 ◽  
Author(s):  
Tsatsral Amarbayasgalan ◽  
Van Huy Pham ◽  
Nipon Theera-Umpon ◽  
Keun Ho Ryu

Automatic anomaly detection for time-series is critical in a variety of real-world domains such as fraud detection, fault diagnosis, and patient monitoring. Current anomaly detection methods detect the remarkably low proportion of the actual abnormalities correctly. Furthermore, most of the datasets do not provide data labels, and require unsupervised approaches. By focusing on these problems, we propose a novel deep learning-based unsupervised anomaly detection approach (RE-ADTS) for time-series data, which can be applicable to batch and real-time anomaly detections. RE-ADTS consists of two modules including the time-series reconstructor and anomaly detector. The time-series reconstructor module uses the autoregressive (AR) model to find an optimal window width and prepares the subsequences for further analysis according to the width. Then, it uses a deep autoencoder (AE) model to learn the data distribution, which is then used to reconstruct a time-series close to the normal. For anomalies, their reconstruction error (RE) was higher than that of the normal data. As a result of this module, RE and compressed representation of the subsequences were estimated. Later, the anomaly detector module defines the corresponding time-series as normal or an anomaly using a RE based anomaly threshold. For batch anomaly detection, the combination of the density-based clustering technique and anomaly threshold is employed. In the case of real-time anomaly detection, only the anomaly threshold is used without the clustering process. We conducted two types of experiments on a total of 52 publicly available time-series benchmark datasets for the batch and real-time anomaly detections. Experimental results show that the proposed RE-ADTS outperformed the state-of-the-art publicly available anomaly detection methods in most cases.


Sensors ◽  
2021 ◽  
Vol 21 (12) ◽  
pp. 4237
Author(s):  
Hoon Ko ◽  
Kwangcheol Rim ◽  
Isabel Praça

The biggest problem with conventional anomaly signal detection using features was that it was difficult to use it in real time and it requires processing of network signals. Furthermore, analyzing network signals in real-time required vast amounts of processing for each signal, as each protocol contained various pieces of information. This paper suggests anomaly detection by analyzing the relationship among each feature to the anomaly detection model. The model analyzes the anomaly of network signals based on anomaly feature detection. The selected feature for anomaly detection does not require constant network signal updates and real-time processing of these signals. When the selected features are found in the received signal, the signal is registered as a potential anomaly signal and is then steadily monitored until it is determined as either an anomaly or normal signal. In terms of the results, it determined the anomaly with 99.7% (0.997) accuracy in f(4)(S0) and in case f(4)(REJ) received 11,233 signals with a normal or 171anomaly judgment accuracy of 98.7% (0.987).


IEEE Access ◽  
2021 ◽  
Vol 9 ◽  
pp. 22528-22541
Author(s):  
Ruifeng Duo ◽  
Xiaobo Nie ◽  
Ning Yang ◽  
Chuan Yue ◽  
Yongxiang Wang
Keyword(s):  

Sign in / Sign up

Export Citation Format

Share Document