An anomaly detection system based on variable N-gram features and one-class SVM

Khreich, Wael; Khosravifar, Babak; Hamou-Lhadj, Abdelwahab; Talhi, Chamseddine

doi:10.1016/j.infsof.2017.07.009

Cited by 91 publications

(34 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Among the most frequently used techniques in time series classification, rare event logistic regression, an adaptation of the logistic regression for this learning scenario, is a popular choice (King et al, 2001;Theofilatos et al, 2016;Ren et al, 2016;Van Den Eeckhaut et al, 2006). However, techniques such as Kullback-Leibler divergence to discriminate between rare and normal events (Xu et al, 2016), long-short term neural networks (Zhang et al, 2017), rulebased classification learned with genetic algorithms (Weiss and Hirsh, 1998), multiple-instance naïve Bayes (Murray et al, 2005), Poisson Processes (Dzierma and Wehrmann, 2010), support vector data regression with surrogate functions (Bourinet, 2016), Bayesian networks (Cheon et al, 2009) or support vector machines (Khreich et al, 2017) have been successfully adapted for this learning scenario.…”

Section: Rare Event Detectionmentioning

confidence: 99%

“…In most of the papers that use the term novelty to describe the abnormalities, the model is learned using a dataset that contains only one class. For instance, in Khreich et al (2017), system call traces are classified as novel or normal. A novel instance corresponds to an unsupported or unexpected system call trace.…”

Section: Novelty Detectionmentioning

confidence: 99%

“…According to the techniques used in static novelty detection, one class classification techniques are those which are the most representative ones in this learning scenario. For instance, one class SVM (Dufrenois and Noyer, 2016;Erfani et al, 2016;Khreich et al, 2017), K-Nearest Neighbors data description (Tax, 2001), graph embedded one class classifiers (Mygdalis et al, 2016), one class Random Forests (Désir et al, 2013) and Isolation Forest (Zhang et al, Figure 5b). Finally, the new emerging class is sought.…”

Section: Novelty Detectionmentioning

confidence: 99%

See 2 more Smart Citations

Analyzing rare event, anomaly, novelty and outlier detection terms under the supervised classification framework

2019

View full text Add to dashboard Cite

In recent years, a variety of research areas have contributed to a set of related problems with rare event, anomaly, novelty and outlier detection terms as the main actors. These multiple research areas have created a mix-up between terminology and problems. In some research, similar problems have been named differently; while in some other works, the same term has been used to describe different problems. This confusion between terms and problems causes the repetition of research and hinders the advance of the field. Therefore, a standardization is imperative. The goal of this paper is to underline the differences between each term, and organize the area by looking at all these terms under the umbrella of supervised classification. Therefore, a one-to-one assignment of terms to learning scenarios is proposed. In fact, each learning scenario is associated with the term most frequently used in the literature. In order to validate this proposal, a set of experiments retrieving papers from Google Scholar, ACM Digital Library and IEEE Xplore has been carried out.

show abstract

Section: Rare Event Detectionmentioning

confidence: 99%

Section: Novelty Detectionmentioning

confidence: 99%

Section: Novelty Detectionmentioning

confidence: 99%

See 1 more Smart Citation

Analyzing rare event, anomaly, novelty and outlier detection terms under the supervised classification framework

2019

View full text Add to dashboard Cite

show abstract

“…The proposed method uses the output results from one-class classifier types. Classifiers like the OneClassSVM classifier are proven to be efficient in outliers detection [18]. We use one-class classifiers because our method only needs to differentiate good (expected) metadata reads from abnormal ones.…”

Section: Classifiers Comparisonmentioning

confidence: 99%

A Smart Trust Management Method to Detect On-Off Attacks in the Internet of Things

Caminha

Perkusich

2018

Security and Communication Networks

View full text Add to dashboard Cite

Internet of Things (IoT) resources cooperate with themselves for requesting and providing services. In heterogeneous and complex environments, those resources must trust each other. On-Off attacks threaten the IoT trust security through nodes performing good and bad behaviors randomly, to avoid being rated as a menace. Some countermeasures demand prior levels of trust knowledge and time to classify a node behavior. In some cases, a malfunctioning node can be mismatched as an attacker. In this paper, we introduce a smart trust management method, based on machine learning and an elastic slide window technique that automatically assesses the IoT resource trust, evaluating service provider attributes. In simulated and real-world data, this method was able to identify On-Off attackers and fault nodes with a precision up to 96% and low time consumption.

show abstract

“…More importantly, adopting a probabilistic policy in novelty detection enables us to estimate the generative probability density function of the normal data, which can cover a wide and heterogeneous spectrum of normal samples. These advantages made novelty detection techniques very successful in many applications ranging from fraud detection [ 17 , 18 ], medical diagnosis [ 19 , 20 , 21 ], fault detection [ 22 , 23 ], to anomaly and outlier detection in sensor networks [ 24 , 25 ], video surveillance [ 26 , 27 ] and text mining [ 28 , 29 ].…”

Section: Introductionmentioning

confidence: 99%

Novelty Detection using Deep Normative Modeling for IMU-Based Abnormal Movement Monitoring in Parkinson’s Disease and Autism Spectrum Disorders

Rad

Laarhoven

Furlanello

et al. 2018

Sensors

View full text Add to dashboard Cite

Detecting and monitoring of abnormal movement behaviors in patients with Parkinson’s Disease (PD) and individuals with Autism Spectrum Disorders (ASD) are beneficial for adjusting care and medical treatment in order to improve the patient’s quality of life. Supervised methods commonly used in the literature need annotation of data, which is a time-consuming and costly process. In this paper, we propose deep normative modeling as a probabilistic novelty detection method, in which we model the distribution of normal human movements recorded by wearable sensors and try to detect abnormal movements in patients with PD and ASD in a novelty detection framework. In the proposed deep normative model, a movement disorder behavior is treated as an extreme of the normal range or, equivalently, as a deviation from the normal movements. Our experiments on three benchmark datasets indicate the effectiveness of the proposed method, which outperforms one-class SVM and the reconstruction-based novelty detection approaches. Our contribution opens the door toward modeling normal human movements during daily activities using wearable sensors and eventually real-time abnormal movement detection in neuro-developmental and neuro-degenerative disorders.

show abstract

An anomaly detection system based on variable N-gram features and one-class SVM

Cited by 91 publications

References 22 publications

Analyzing rare event, anomaly, novelty and outlier detection terms under the supervised classification framework

Analyzing rare event, anomaly, novelty and outlier detection terms under the supervised classification framework

A Smart Trust Management Method to Detect On-Off Attacks in the Internet of Things

Novelty Detection using Deep Normative Modeling for IMU-Based Abnormal Movement Monitoring in Parkinson’s Disease and Autism Spectrum Disorders

Contact Info

Product

Resources

About