A Contextual Anomaly Detection Approach to Discover Zero-Day Attacks

Aleroud, Ahmed; Karabatis, George

doi:10.1109/cybersecurity.2012.12

Cited by 36 publications

(21 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This component is evaluated over the records individually to determine whether connections between records indicate anomalous values. The work presented by AlEroud et al [14] is similar to the work presented in this paper in that the detection is composed of two distinct modules. However, the content component of their work involves calculating difficult distance measures that are not always easily definable.…”

Section: Profilementioning

confidence: 53%

See 1 more Smart Citation

Contextual anomaly detection framework for big sensor data

Hayes

Capretz

2015

Journal of Big Data

102

View full text Add to dashboard Cite

The ability to detect and process anomalies for Big Data in real-time is a difficult task. The volume and velocity of the data within many systems makes it difficult for typical algorithms to scale and retain their real-time characteristics. The pervasiveness of data combined with the problem that many existing algorithms only consider the content of the data source; e.g. a sensor reading itself without concern for its context, leaves room for potential improvement. The proposed work defines a contextual anomaly detection framework. It is composed of two distinct steps: content detection and context detection. The content detector is used to determine anomalies in real-time, while possibly, and likely, identifying false positives. The context detector is used to prune the output of the content detector, identifying those anomalies which are considered both content and contextually anomalous. The context detector utilizes the concept of profiles, which are groups of similarly grouped data points generated by a multivariate clustering algorithm. The research has been evaluated against two real-world sensor datasets provided by a local company in Brampton, Canada. Additionally, the framework has been evaluated against the open-source Dodgers dataset, available at the UCI machine learning repository, and against the R statistical toolbox.

show abstract

Section: Profilementioning

confidence: 53%

“…A different approach for contextual detection is that work of AlEroud et al [14], who apply contextual anomaly detection to uncover zero-day cyber attacks. Their work involves two distinct steps, similar to the modules described in this paper: contextual misuse module, and an anomaly detection technique.…”

Section: Profilementioning

confidence: 99%

Contextual anomaly detection framework for big sensor data

Hayes

Capretz

2015

Journal of Big Data

102

View full text Add to dashboard Cite

show abstract

“…A different approach for contextual detection is that work of AlEroud et al [19], who apply contextual anomaly detection to uncover zero-day cyber attacks. Their work involves two distinct steps, similar to the modules described in this paper: contextual misuse module, and an anomaly detection technique.…”

Section: Processing Pipelinementioning

confidence: 99%

A data-driven approach for multivariate contextualized anomaly detection: Industry use case

Stojanović

Dinic

Stojanović

2017

2017 IEEE International Conference on Big Data (Big Data)

View full text Add to dashboard Cite

Abstract-Anomaly detection is the process of discovering some anomalous behaviour in the real-time operation of a system. It is a difficult task, since in a general case (multivariate anomaly detection, an anomaly can be related to the behaviour of several parameters which are not necessarily behaving anomalously per se, but their (complex) relation is anomalous (not usual/normal). This implies the need for a very efficient modeling of the normal behavior in order to know what should be treated as anomalous/outlier/unusual. Consequently, classical model-driven approaches, due to their focusing on the selected parameters for creating models, are not able to model the behavior if the whole system. This is why data-driven approaches for anomaly detection are getting ever more important for the industry use cases where hundreds (thousands) of parameter should be taken into account. However, current approaches are usually focused on the univariate anomaly detection (or some variations of it), so without going into observing the entire space of relations (computation very difficult). In this paper we present a novel approach for the multivariate anomaly detection that is based on modeling and managing the streams of variations in a multidimensional space. The main advantage of this approach is the possibility to observe the relations between variations of a large set of parameters and create clusters of "normal/usual" variations. In order to ensure scaling, which is one of the most challenging requirements, the approach is based on the usage of the big data technologies for realizing data analytics tasks/calculations. The approach is realized as a part of D2Lab (Data Diagnostics Laboratory) framework and has been applied in several industrial use cases. In this paper we present a very interesting usage for the anomaly detection in the process of functional testing of home appliances devices (in particular case refrigerators) after manufacturing/assembling process. It has been done for a bug vendor (Whirlpool), who expects huge saving in testing and improved customer satisfaction from this approach.

show abstract

“…Contextual Anomaly Detection [17] is a contextual misuse and anomaly detection prototype to detect zeroday attacks. The contextual misuse detection utilizes similarity with attack context profiles, and the anomaly detection technique identifies new types of attacks using the One Class Nearest Neighbor (1-NN) algorithm.…”

Section: Related Workmentioning

confidence: 99%

A Hybrid Real-time Zero-day Attack Detection and Analysis System

Kaur

Singh²

2015

IJCNIS

View full text Add to dashboard Cite

Abstract-A zero-day attack poses a serious threat to the Internet security as it exploits zero-day vulnerabilities in the computer systems. Attackers take advantage of the unknown nature of zero-day exploits and use them in conjunction with highly sophisticated and targeted attacks to achieve stealthiness with respect to standard intrusion detection techniques. Thus, it's difficult to defend against such attacks. Present research exhibits various issues and is not able to provide complete solution for the detection and analysis of zero-day attacks. This paper presents a novel hybrid system that integrates anomaly, behavior and signature based techniques for detecting and analyzing zero-day attacks in real-time. It has layered and modular design which helps to achieve high performance, flexibility and scalability. The system is implemented and evaluated against various standard metrics like True Positive Rate (TPR), False Positive Rate (FPR), FMeasure, Total Accuracy (ACC) and Receiver Operating Characteristic (ROC) curve. The result shows high detection rate with nearly zero false positives. Additionally, the proposed system is compared with Honeynet system.

show abstract

A Contextual Anomaly Detection Approach to Discover Zero-Day Attacks

Cited by 36 publications

References 12 publications

Contextual anomaly detection framework for big sensor data

Contextual anomaly detection framework for big sensor data

A data-driven approach for multivariate contextualized anomaly detection: Industry use case

A Hybrid Real-time Zero-day Attack Detection and Analysis System

Contact Info

Product

Resources

About