Automatic feature selection for anomaly detection

Abstract

A frequent problem in anomaly detection is to decide among different feature sets to be used. For example, various features are known in network intrusion detection based on packet headers, content byte streams or application level protocol parsing. A method for automatic feature selection in anomaly detection is proposed which determines optimal mixture coefficients for various sets of features. The method generalizes the support vector data description (SVDD) and can be expressed as a semi-infinite linear program that can be solved with standard techniques. The case of a single feature set can be handled as a particular case of the proposed method. The experimental evaluation of the new method on unsanitized HTTP data demonstrates that detectors using automatically selected features attain competitive performance, while sparing practitioners from a priori decisions on feature sets to be used

Corporate security solutions for BYOD: A novel user-centric and self-adaptive system

“…Authors have used DM techniques in previous works, but usually aiming for a specific general objective, for instance the detection of threats such as botnet (70), or the recognition of anomalies (71). However, these works do not contemplate any process to improve the system as the refinement phase in MUSES.…”

Anomaly detection in wireless sensor networks: A survey

“…This nature of attribute makes it a critical research problem. Furthermore, a reduced set of attributes can improve the detection speed as well as the detection accuracy remarkably (Chebrolu et al, 2005;Kloft et al, 2008). But, this problem remains open in the anomaly detection of WSNs, despite little progress has been sporadically made (Silva et al, 2005;Ho et al, 2009).…”

“…For example, packet arrival interval (Onat and Miri, 2005a) is just a derived attribute calculated by the difference between packet arrival times, where the packet arrival time is an atomic attribute. Third, explore the interrelationship with a variety of advanced techniques, such as support vector data description (SVDD) (Kloft et al, 2008), Bayesian networks (BN), classification and regression trees (CART) (Chebrolu et al, 2005), and fuzzy and rough sets (Jensen and Shen, 2009). …”

A new feature selection model based on ID3 and bees algorithm for intrusion detection system

“…They used the BA for subset generating and the SVM for the classification process in anomaly detection. Kloft et al [8] proposed a generalization of the support vector data description (SVDD) that can select the best feature combination. SVDD is described as a semiinfinite linear program that can be solved with standard techniques.…”