A fuzzy anomaly detection system based on hybrid PSO-Kmeans algorithm in content-centric networks

Abstract

In Content-Centric Networks (CCNs) as a possible future Internet, new kinds of attacks and security challenges -from Denial of Service (DoS) to privacy attacks-will arise. An efficient and effective security mechanism is required to secure content and defense against unknown and new forms of attacks and anomalies. Usually, clustering algorithms would fit the requirements for building a good anomaly detection system. K-means is a popular anomaly detection method to classify data into different categories. However, it suffers from the local convergence and sensitivity to selection of the cluster centroids. In this paper, we present a novel fuzzy anomaly detection system that works in two phases. In the first phase -the training phase-we propose an hybridization of Particle Swarm Optimization (PSO) and K-means algorithm with two simultaneous cost functions as well-separated clusters and local optimization to determine the optimal number of clusters. When the optimal placement of clusters centroids and objects are defined, it starts the second phase. In this phase -the detection phase-we employ a fuzzy approach by the combination of two distance-based methods as classification and outlier to detect anomalies in new monitoring data. Experimental results demonstrate that the proposed algorithm can achieve to the optimal number of clusters, well-separated clusters, as well as increase the high detection rate and decrease the false positive rate at the same time when compared to some other well-known clustering algorithms.

An Intelligent Content Prefix Classification Approach for Quality of Service Optimization in Information-Centric Networking

“…Particle swarm optimization (PSO) was motivated by social behavior of birds (as particles) when attempting to get to an unknown destination [10]. The particles swarm through the search space and update their positions.…”

ACCPndn: Adaptive Congestion Control Protocol in Named Data Networking by learning capacities using optimized Time-Lagged Feedforward Neural Network

“…Therefore Interest packets cannot loop. Each NDN router maintains three major data structures [43,44] …”

“…A fuzzy system often consists of four main parts: fuzzification, rules, inference engine, and defuzzification [43]. In the fuzzification step, a crisp set of input data is converted to a fuzzy set using fuzzy linguistic terms and membership functions.…”

Selecting locally specialised classifiers for one-class classification ensembles

“…In such a case, OCC is the most proper solution. One may bring more examples of the potential use of OCC, such as image/video classification (where it is impossible to determine what will appear on the scene) [7], data stream analysis (where new, unknown classes may appear due to data shifts and drifts) [15,35], novelty detection [21] or bio-signal classification (where some pathologies may be dependent on the patient) [13].…”