Accurate anomaly detection through parallelism

Intrusion detection system: A comprehensive review

“…False positive (FP) and false negative (FN) are two indicators to assess the degree of accuracy. The former occurs when IDS incorrectly identifies benign activity as being malicious, whereas the latter comes about if IDS fails to identify malicious activity (Stavroulakis and Stamp, 2010;Elshousha and Osmanb, 2011;Shanbhag and Wolf, 2009;Ho et al, 2012). Under the circumstances of failing to have the best of both worlds, many security administrators prefer decreasing FNs to increasing FPs due to the high security consideration.…”

Human error tolerant anomaly detection based on time-periodic packet sampling

“…To mitigate this variation, we employ an ensemble anomaly detection method [8] that exploits the multiple baseline models trained using multiple sets of labeled-and-sampled/sampled-andlabeled data. A similar idea proposed in [25][26][27] exploits multiple existing anomaly detection systems in parallel. Since the multiple sets of labeled-andsampled/sampled-and-labeled data would have information about different features of the normal behavior of network traffic, the ensemble of the multiple baseline models trained using these heterogeneous data improves performance in anomaly detection more effectively than using a single baseline model.…”

Unsupervised Ensemble Anomaly Detection through Time-Periodical Packet Sampling

“…A number of these approaches are variations of the change detection method, e.g., adaptive threshold [12], cumulative sum [13], wavelets [14], and maximum entropy [15]. In addition, an approach exploiting multiple existing anomaly detection algorithms in parallel has been used to increase the accuracy of anomaly detection [16].…”

“…Therefore, to mitigate the performance variation, we also devised an unsupervised ensemble anomaly detection method that exploits multiple baseline distributions trained using multiple sets of sampled data. A similar idea is proposed in [16], which exploits multiple existing anomaly detection systems in parallel. Our method does simultaneous time-periodical packet samplings.…”