An Automatic and Dynamic Parameter Tuning of a Statistics-Based Anomaly Detection Algorithm

Himura, Yosuke; Fukuda, Kensuke; Cho, K.; Esaki, Hiroshi

doi:10.1109/icc.2009.5198722

Cited by 17 publications

(12 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recently there are a few studies on tuning specific models online [5,8,15]. The work in [15] examined the sensitivity of PCA to parameter settings and found that minor changes to the parameter settings increased the false positive rate by a factor of three or more.…”

Section: Related Workmentioning

confidence: 98%

“…The work in [15] examined the sensitivity of PCA to parameter settings and found that minor changes to the parameter settings increased the false positive rate by a factor of three or more. Himura et al investigated the effect of on-line parameter tuning for the SKETCH algorithm [8]. A method for automatically learning optimal parameter setting and dynamically adapting the learning period was proposed.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

A self-tuning self-optimizing approach for automated network anomaly detection systems

Ippoliti

Zhou

2012

Proceedings of the 9th International Conference on Autonomic Computing

View full text Add to dashboard Cite

Parameter tuning in network anomaly detection systems is typically accomplished off-line and in an ad-hoc fashion. For operational deployment in a variety of conditions, it is important but challenging for a system to adaptively tune itself meeting performance goals and constraints. We propose and develop a self-tuning self-optimizing approach for automated network anomaly detection systems. Operators set performance expectations and priorities on a collection of metrics. A controller based on reinforcement learning and neural networks automatically performs control actions to meet expectations according to defined priorities. Tuning is accomplished without requiring direct operator access to system parameters. We examine the approach on AGHSOM anomaly detection system. We validate its effectiveness using a dataset consisting of both live trace and simulated network events. Experimental results show that the approach can self-calibrate its control parameters to meet operator performance requirements. It can self-optimize itself by maximizing individual performance metrics subject to the operator defined constraints. This work is a significant step towards building automated anomaly detection systems.

show abstract

Section: Related Workmentioning

confidence: 98%

Section: Related Workmentioning

confidence: 99%

A self-tuning self-optimizing approach for automated network anomaly detection systems

Ippoliti

Zhou

2012

Proceedings of the 9th International Conference on Autonomic Computing

View full text Add to dashboard Cite

show abstract

“…Identification and detection of nonlinear energy anomalies of system-related events can be performed using thresholds and a multivariate transformation based on multicasting information, monitoring tools and intensity matrices [16]. Usually, when using statistics to detect anomalies, a categorization is performed in advance to assemble heuristics in groups [9]. Finally, rather than indicating failures, anomalies can also expose abnormal situations or configurations [16].…”

Section: Related Workmentioning

confidence: 99%

Monitoring energy consumption with SIOX

et al. 2014

View full text Add to dashboard Cite

In the face of the growing complexity of HPC systems, their growing energy costs, and the increasing difficulty to run applications efficiently, a number of monitoring tools have been developed during the last years. SIOX is one such endeavor, with a uniquely holistic approach: Not only does it aim to record a certain kind of data, but to make all relevant data available for analysis and optimization. Among other sources, this encompasses data from hardware energy counters and trace data from different hardware/software layers. However, not all data that can be recorded should be recorded. As such, SIOX needs good heuristics to determine when and what data needs to be collected, and the energy consumption can provide an important signal about when the system is in a state that deserves closer attention. In this paper, we show that SIOX can use Likwid to collect and report the energy consumption of applications, and present how this data can be visualized using SIOX's web-interface. Furthermore, we outline how SIOX can use this information to intelligently adjust the amount of data it collects, allowing it to reduce the monitoring overhead while still providing complete information about critical situations.

show abstract

“…Consequently, anomaly detection has received a lot of attention in the last decade, and numerous detectors have been proposed. Operators, however, often disregard the alarms reported by anomaly detectors because of several drawbacks discrediting them [10,21,23,24]. The key task for improving anomaly detectors is to thoroughly evaluate their output.…”

Section: Introductionmentioning

confidence: 99%

Improving an SVD-based combination strategy of anomaly detectors for traffic labelling

Mazel¹,

Esaki

Fontugne

et al. 2012

Proceedings of the Asian Internet Engineeering Conference on - AINTEC '12

View full text Add to dashboard Cite

Network anomaly detection is a crucial task in traffic monitoring. Tools targeting this particular problematic need to be thoroughly evaluated to assess their efficiency. Such evaluation needs reliable ground truth data to be effective. The goal of the present article is to assist researchers in the evaluation of detectors by providing them with labelled anomaly traffic traces. One of the promising strategies to provide reliable ground truth data is to combine the output of the multiple anomaly detectors with different theoretical background. In this paper, we provide an in-depth analysis of the Singular Value Decomposition (SVD) based combination strategy that has been recently applied to anomaly detectors (MAWILab). This analysis highlights the key drawback of the method to efficiently discriminate the anomalous traffic from the harmless one. We then propose several techniques to overcome this drawback and improve the discrimination power of the combination strategy. Our evaluation using four anomaly detectors and four years of real backbone traffic traces (MAWI) emphasizes the accuracy gain of the proposed techniques over the original study.

show abstract

An Automatic and Dynamic Parameter Tuning of a Statistics-Based Anomaly Detection Algorithm

Cited by 17 publications

References 9 publications

A self-tuning self-optimizing approach for automated network anomaly detection systems

A self-tuning self-optimizing approach for automated network anomaly detection systems

Monitoring energy consumption with SIOX

Improving an SVD-based combination strategy of anomaly detectors for traffic labelling

Contact Info

Product

Resources

About