Classifiers for Behavioral Patterns Identification Induced from Huge Temporal Data

Abstract

Abstract.A new method of constructing classifiers from huge volume of temporal data is proposed in the paper. The novelty of introduced method lies in a multi-stage approach to constructing hierarchical classifiers that combines process mining, feature extraction based on temporal patterns and constructing classifiers based on a decision tree. Such an approach seems to be practical when dealing with huge volume of temporal data. As a proof of concept a system has been constructed for packet-based network traffic anomaly detection, where anomalies are represented by spatio-temporal complex concepts and called by behavioral patterns. Hierarchical classifiers constructed with the new approach turned out to be better than "flat" classifiers based directly on captured network traffic data.

An Entropy-Based Network Anomaly Detection Method

“…In several review papers [26][27][28][29][30][31][32] various network anomaly detection methods have been summarized. From aforementioned surveys one can find that the most effective methods of network anomaly detection are Principle Component Analysis [33][34][35], Wavelet analysis [36][37][38], Markovian models [39,40], Clustering [41][42][43], Histograms [44,45], Sketches [46,47], and Entropies [8,15,48].…”

Extracting of temporal patterns from data for hierarchical classifiers construction

“…Hierarchical behavioral patterns based classifiers (HBPB classifiers for short) have been proposed in [13]. They constitute a new approach for constructing classifiers from huge volume of temporal data.…”

“…, ϕ m and the decision attribute d. Finally, we remove duplicate rows from the high level data, to ensure scalability of our approach. The result are the reduced data, which are used to build the classifier based on a decision tree [13].…”

“…The approach considered in this paper is based on hierarchical behavioral patterns based classifiers initially described in [13]. The decision provided by such a classifier is based on a presence and/or absence of some temporal patterns in the considered data.…”

“…The decision provided by such a classifier is based on a presence and/or absence of some temporal patterns in the considered data. The temporal patterns describe legitimate or illegitimate network traffic and has been successfully used to recognize selected network attacks [13]. The temporal patterns used in the previous approach have been defined by experts.…”