Machine learning approaches to network anomaly detection

Authors:
Tarem Ahmed;Boris Oreshkin;Mark Coates
Affiliations:
Department of Electrical and Computer Engineering, McGill University, Montreal, QC, Canada;Department of Electrical and Computer Engineering, McGill University, Montreal, QC, Canada;Department of Electrical and Computer Engineering, McGill University, Montreal, QC, Canada
Venue:
SYSML'07 Proceedings of the 2nd USENIX workshop on Tackling computer systems problems with machine learning techniques
Year:
2007

Citing 13
Cited 9

Online novelty detection on temporal sequences

Proceedings of the ninth ACM SIGKDD international conference on Knowledge discovery and data mining
On-Line Unsupervised Outlier Detection Using Finite Mixtures with Discounting Learning Algorithms

Data Mining and Knowledge Discovery
Structural analysis of network traffic flows

Proceedings of the joint international conference on Measurement and modeling of computer systems
Diagnosing network-wide traffic anomalies

Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications
Aberrant Behavior Detection in Time Series for Network Monitoring

LISA '00 Proceedings of the 14th USENIX conference on System administration
Mining anomalies using traffic feature distributions

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Estimation of High-Density Regions Using One-Class Neighbor Machines

IEEE Transactions on Pattern Analysis and Machine Intelligence
Detecting outliers using transduction and statistical testing

Proceedings of the 12th ACM SIGKDD international conference on Knowledge discovery and data mining
Adaptive event detection with time-varying poisson processes

Proceedings of the 12th ACM SIGKDD international conference on Knowledge discovery and data mining
Learning Minimum Volume Sets

The Journal of Machine Learning Research
One-Class Novelty Detection for Seizure Analysis from Intracranial EEG

The Journal of Machine Learning Research
The kernel recursive least-squares algorithm

IEEE Transactions on Signal Processing
Statistical analysis of network traffic for adaptive faults detection

IEEE Transactions on Neural Networks

Machine learning despite unknown classes

SMC'09 Proceedings of the 2009 IEEE international conference on Systems, Man and Cybernetics
Data stream anomaly detection through principal subspace tracking

Proceedings of the 2010 ACM Symposium on Applied Computing
Online anomaly detection using KDE

GLOBECOM'09 Proceedings of the 28th IEEE conference on Global telecommunications
AnomBench: a benchmark for volume-based internet anomaly detection

GLOBECOM'09 Proceedings of the 28th IEEE conference on Global telecommunications
Time-series data mining

ACM Computing Surveys (CSUR)
Root cause detection in a service-oriented architecture

Proceedings of the ACM SIGMETRICS/international conference on Measurement and modeling of computer systems
Network anomaly detection with the restricted Boltzmann machine

Neurocomputing
Probabilistic local reconstruction for k-NN regression and its application to virtual metrology in semiconductor manufacturing

Neurocomputing
Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments

Computer Networks: The International Journal of Computer and Telecommunications Networking

Quantified Score

Hi-index	0.00

Visualization

Abstract

Networks of various kinds often experience anomalous behaviour. Examples include attacks or large data transfers in IP networks, presence of intruders in distributed video surveillance systems, and an automobile accident or an untimely congestion in a road network. Machine learning techniques enable the development of anomaly detection algorithms that are non-parametric, adaptive to changes in the characteristics of normal behaviour in the relevant network, and portable across applications. In this paper we use two different datasets, pictures of a highway in Quebec taken by a network of webcams and IP traffic statistics from the Abilene network, as examples in demonstrating the applicability of two machine learning algorithms to network anomaly detection. We investigate the use of the block-based One-Class Neighbour Machine and the recursive Kernel-based Online Anomaly Detection algorithms.