Combining one-class classifiers via meta learning

Menahem, Eitan; Rokach, Lior; Elovici, Yuval

doi:10.1145/2505515.2505619

Cited by 29 publications

(24 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Using the well known OCSVM method with default values for parameters σ and ν we distinguish real from false alarms with the use of a recursive k-means clustering method. This is very different from all previous methods that required pre-selection of parameters with the use of cross-validation or other methods that ensemble of One class classifiers [9].…”

Section: Introductionmentioning

confidence: 81%

A real time OCSVM Intrusion Detection module with low overhead for SCADA systems

Μαγλαράς¹,

Jiang²

2014

ijarai

View full text Add to dashboard Cite

Abstract-In this paper we present a intrusion detection module capable of detecting malicious network traffic in a SCADA (Supervisory Control and Data Acquisition) system. Malicious data in a SCADA system disrupt its correct functioning and tamper with its normal operation. OCSVM (One-Class Support Vector Machine) is an intrusion detection mechanism that does not need any labeled data for training or any information about the kind of anomaly is expecting for the detection process. This feature makes it ideal for processing SCADA environment data and automate SCADA performance monitoring. The OCSVM module developed is trained by network traces off line and detect anomalies in the system real time.In order to decrease the overhead induced by communicated alarms we propose a new detection mechanism that is based on the combination of OCSVM with a recursive k-means clustering procedure. The proposed intrusion detection module K−OCSVM is capable to distinguish severe alarms from possible attacks regardless of the values of parameters σ and ν, making it ideal for real-time intrusion detection mechanisms for SCADA systems. The most severe alarms are then communicated with the use of IDMEF files to an IDSIDS (Intrusion Detection System) system that is developed under CockpitCI project. Alarm messages carry information about the source of the incident, the time of the intrusion and a classification of the alarm.

show abstract

Section: Introductionmentioning

confidence: 81%

A real time OCSVM Intrusion Detection module with low overhead for SCADA systems

Μαγλαράς¹,

Jiang²

2014

ijarai

View full text Add to dashboard Cite

show abstract

“…Other related work further indicated that it was impossible to determine if meta-learning methods can outperform other methods such as weighting as the best method for the problem at hand depends largely upon the dataset being used and the prior knowledge to be gained [59,61]. Moreover, among the weighting methods, mean, median and majority voting are more commonly used and tend to perform better more often than others according to Menahem et al [62]. Therefore in this research, we select the weighting method of weighted majority vote because of its impressive performance and the employment of small facial image datasets (<1000 instances) in our application domain.…”

Section: Facial Emotion Recognition Using An Adaptive Ensemble Classimentioning

confidence: 99%

Intelligent facial emotion recognition using a layered encoding cascade optimization model

Neoh

Zhang

Mistry

et al. 2015

Applied Soft Computing

View full text Add to dashboard Cite

“…According to [13], up until 2008, this research field was relatively new and had not been thoroughly explored. In particular, in the setup of diverse ensemble members, only two combining methods were considered for one-class problems: the fix-rule [42,18] and meta-learning [29] ensembles.…”

Section: One-class Ensemble Learningmentioning

confidence: 99%

“…Lastly , ACTIDS uses the TUPSO ensemble scheme [29] to train the CDS's classifier, which is responsible for combining the Sensors' local anomaly score during the prediction phase. [29]), f (·), to P m . Each such aggregation represents a single feature (i.e., column) in the combiner's train-set.…”

Section: Training Phasementioning

confidence: 99%

Actids

Menahem

Elovici

Amar

et al. 2013

Proceedings of the 2013 ACM Workshop on Artificial Intelligence and Security

Self Cite

View full text Add to dashboard Cite

In this work we investigate a new approach for detecting attacks which aim to degrade the network's Quality of Service (QoS). To this end, a new network-based intrusion detection system (NIDS) is proposed. Most contemporary NIDSs take a passive approach by solely monitoring the network's production traffic. This paper explores a complementary approach in which distributed agents actively send out periodic probes. The probes are continuously monitored to detect anomalous behavior of the network. The proposed approach takes away much of the variability of the network's production traffic that makes it so difficult to classify. This enables the NIDS to detect more subtle attacks which would not be detected using the passive approach alone. Furthermore, the active probing approach allows the NIDS to be effectively trained using only examples of the network's normal states, hence enabling an effective detection of zeroday attacks. Using realistic experiments, we show that an NIDS which also leverages the active approach is considerably more effective in detecting attacks which aim to degrade the network's QoS when compared to an NIDS which relies solely on the passive approach.

show abstract

Combining one-class classifiers via meta learning

Cited by 29 publications

References 32 publications

A real time OCSVM Intrusion Detection module with low overhead for SCADA systems

A real time OCSVM Intrusion Detection module with low overhead for SCADA systems

Intelligent facial emotion recognition using a layered encoding cascade optimization model

Actids

Contact Info

Product

Resources

About