Auto-Threshold Deep SVDD for Anomaly-based Web Application Firewall

Vector Data ◽

Protecting websites and applications from cyber-threats is vital for any organization. A Web application firewall (WAF) prevents attacks to damaging applications. This provides a web security by filtering and monitoring traffic network to protect against attacks. A WAF solution based on the anomaly detection can identify zero-day attacks. Deep learning is the state-of-the-art method that is widely used to detect attacks in the anomaly-based WAF area. Although deep learning has demonstrated excellent results on anomaly detection tasks in web requests, there is trade-off between false-positive and missed-attack rates which is a key problem in WAF systems. On the other hand, anomaly detection methods suffer adjusting threshold-level to distinguish attack and normal traffic. In this paper, first we proposed a model based on Deep Support Vector Data Description (Deep SVDD), then we compare two feature extraction strategies, one-hot and bigram, on the raw requests. Second to overcome threshold challenges, we introduce a novel end-to-end algorithm Auto-Threshold Deep SVDD (ATDSVDD) to determine an appropriate threshold during the learning process. As a result we compare our model with other deep models on CSIC-2010 and ECML/PKDD-2007 datasets. Results show ATDSVDD on bigram feature data have better performance in terms of accuracy and generalization. <br>

Bridge health anomaly detection using deep support vector data description

Neurocomputing ◽

10.1016/j.neucom.2020.08.087 ◽

2021 ◽

Author(s):

JianXi Yang ◽

Fei Yang ◽

Likai Zhang ◽

Ren Li ◽

Shixin Jiang ◽

...

Keyword(s):

Anomaly Detection ◽

Support Vector ◽

Vector Data ◽

Data Description ◽

Finding new physics without learning about it: anomaly detection as a tool for searches at colliders

The European Physical Journal C ◽

10.1140/epjc/s10052-020-08807-w ◽

2021 ◽

Vol 81 (1) ◽

Cited By ~ 1

Author(s):

M. Crispim Romão ◽

N. F. Castro ◽

R. Pedro

Keyword(s):

Anomaly Detection ◽

New Physics ◽

Machine Learning Techniques ◽

Detection Methods ◽

Support Vector ◽

Vector Data ◽

Detection Techniques ◽

Learning Techniques ◽

New Strategy

AbstractIn this paper we propose a new strategy, based on anomaly detection methods, to search for new physics phenomena at colliders independently of the details of such new events. For this purpose, machine learning techniques are trained using Standard Model events, with the corresponding outputs being sensitive to physics beyond it. We explore three novel AD methods in HEP: Isolation Forest, Histogram-Based Outlier Detection, and Deep Support Vector Data Description; alongside the most customary Autoencoder. In order to evaluate the sensitivity of the proposed approach, predictions from specific new physics models are considered and compared to those achieved when using fully supervised deep neural networks. A comparison between shallow and deep anomaly detection techniques is also presented. Our results demonstrate the potential of semi-supervised anomaly detection techniques to extensively explore the present and future hadron colliders’ data.

Multi-Perspective Anomaly Detection

Sensors ◽

10.3390/s21165311 ◽

2021 ◽

Vol 21 (16) ◽

pp. 5311

Author(s):

Peter Jakob ◽

Manav Madan ◽

Tobias Schmid-Schirling ◽

Abhinav Valada

Keyword(s):

Anomaly Detection ◽

Manufacturing Industry ◽

Support Vector ◽

Vector Data ◽

Late Fusion ◽

Multiple Perspectives ◽

Augmentation Techniques ◽

Drill Holes ◽

Anomaly detection is a critical problem in the manufacturing industry. In many applications, images of objects to be analyzed are captured from multiple perspectives which can be exploited to improve the robustness of anomaly detection. In this work, we build upon the deep support vector data description algorithm and address multi-perspective anomaly detection using three different fusion techniques, i.e., early fusion, late fusion, and late fusion with multiple decoders. We employ different augmentation techniques with a denoising process to deal with scarce one-class data, which further improves the performance (ROC AUC =80%). Furthermore, we introduce the dices dataset, which consists of over 2000 grayscale images of falling dices from multiple perspectives, with 5% of the images containing rare anomalies (e.g., drill holes, sawing, or scratches). We evaluate our approach on the new dices dataset using images from two different perspectives and also benchmark on the standard MNIST dataset. Extensive experiments demonstrate that our proposed multi-perspective approach exceeds the state-of-the-art single-perspective anomaly detection on both the MNIST and dices datasets. To the best of our knowledge, this is the first work that focuses on addressing multi-perspective anomaly detection in images by jointly using different perspectives together with one single objective function for anomaly detection.

Network Anomaly Detection Based on Deep Support Vector Data Description

2020 5th IEEE International Conference on Big Data Analytics (ICBDA) ◽

10.1109/icbda49040.2020.9101325 ◽

2020 ◽

Cited By ~ 1

Author(s):

Xiaoqing Chen ◽

Chunjie Cao ◽

Jianbin Mai

Keyword(s):

Anomaly Detection ◽

Support Vector ◽

Vector Data ◽

Data Description ◽

Network Anomaly Detection ◽

Anomaly Detection for Hyperspectral Imagery Based on Incremental Support Vector Data Description

2010 International Conference on Multimedia Technology ◽

10.1109/icmult.2010.5631355 ◽

2010 ◽

Author(s):

Liyan Zhang ◽

Yonghua Sun ◽

Dan Meng ◽

Xiaojuan Li

Keyword(s):

Anomaly Detection ◽

Hyperspectral Imagery ◽

Support Vector ◽

Vector Data ◽

Rapid high-performance hyperspectral anomaly detection via global support vector data description

10.1117/12.777164 ◽

2008 ◽

Author(s):

Reuven Meth ◽

Amit Banerjee ◽

Philippe Burlina ◽

Thomas Strat

Keyword(s):

Anomaly Detection ◽

High Performance ◽

Support Vector ◽

Vector Data ◽

Generalized support vector data description for anomaly detection

Pattern Recognition ◽

10.1016/j.patcog.2019.107119 ◽

2020 ◽

Vol 100 ◽

pp. 107119 ◽

Cited By ~ 3

Author(s):

Mehmet Turkoz ◽

Sangahn Kim ◽

Youngdoo Son ◽

Myong K. Jeong ◽

Elsayed A. Elsayed

Keyword(s):

Anomaly Detection ◽

Support Vector ◽

Vector Data ◽

A new approach of anomaly detection in wireless sensor networks using support vector data description

International Journal of Distributed Sensor Networks ◽

10.1177/1550147716686161 ◽

2017 ◽

Vol 13 (1) ◽

pp. 155014771668616 ◽

Cited By ~ 10

Author(s):

Zhen Feng ◽

Jingqi Fu ◽

Dajun Du ◽

Fuqiang Li ◽

Sizhou Sun

Keyword(s):

Decision Making ◽

Wireless Sensor Networks ◽

Sensor Networks ◽

Computational Complexity ◽

Anomaly Detection ◽

Wireless Sensor ◽

Support Vector ◽

Vector Data ◽

Anomaly detection is an important challenge in wireless sensor networks for some applications, which require efficient, accurate, and timely data analysis to facilitate critical decision making and situation awareness. Support vector data description is well applied to anomaly detection using a very attractive kernel method. However, it has a high computational complexity since the standard version of support vector data description needs to solve quadratic programming problem. In this article, an improved method on the basis of support vector data description is proposed, which reduces the computational complexity and is used for anomaly detection in energy-constraint wireless sensor networks. The main idea is to improve the computational complexity from the training stage and the decision-making stage. First, the strategy of training sample reduction is used to cut back the number of samples and then the sequential minimal optimization algorithm based on the second-order approximation is implemented on the sample set to achieve the goal of reducing the training time. Second, through the analysis of the decision function, the pre-image in the original space corresponding to the center of hyper-sphere in kernel feature space can be obtained. The decision complexity is reduced from O( l) to O(1) using the pre-image. Eventually, the experimental results on several benchmark datasets and real wireless sensor networks datasets demonstrate that the proposed method can not only guarantee detection accuracy but also reduce time complexity.