Ensemble-learning Approaches for Network Security and Anomaly Detection

Vanerio, Juan; Casas, Pedro

doi:10.1145/3098593.3098594

Cited by 74 publications

(31 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Empirically, the ensemble method tends to yield better results when there are significant differences between models. Owing to this notable advantage, the ensemble method is also an effective method to solve anomaly detection problems in cellular networks [2,[20][21][22][23].…”

Section: Ensemble Methodmentioning

confidence: 99%

See 1 more Smart Citation

Anomaly detection for cellular networks using big data analytics

Zhao

Zhang

et al. 2019

IET Communications

View full text Add to dashboard Cite

Large language models (LLMs) have shown their potential in long-context understanding and mathematical reasoning. In this paper, we study the problem of using LLMs to detect tabular anomalies and show that pre-trained LLMs are zeroshot batch-level anomaly detectors. That is, without extra distribution-specific model fitting, they can discover hidden outliers in a batch of data, demonstrating their ability to identify low-density data regions. For LLMs that are not well aligned with anomaly detection and frequently output factual errors, we apply simple yet effective datagenerating processes to simulate synthetic batchlevel anomaly detection datasets and propose an end-to-end fine-tuning strategy to bring out the potential of LLMs in detecting real anomalies. Experiments on a large anomaly detection benchmark (ODDS) showcase i) GPT-4 has on-par performance with the state-of-the-art transductive learning-based anomaly detection methods and ii) the efficacy of our synthetic dataset and fine-tuning strategy in aligning LLMs to this task.

show abstract

Section: Ensemble Methodmentioning

confidence: 99%

“…Different from the direct integration methods in [2,20,21], the super learner method integrating a series of basic learning-based methods is used for anomaly detection in [22,23]. Based on cross validation, a super learner trains a series of general algorithms and weighs the results.…”

Section: Ensemble Methodmentioning

confidence: 99%

Anomaly detection for cellular networks using big data analytics

Zhao

Zhang

et al. 2019

IET Communications

View full text Add to dashboard Cite

show abstract

“…We refer the interested reader to [1] for a detailed survey on the different machine-learning techniques commonly applied to network-traffic analysis. There are multiple recent papers on the application of machine-learning models to networksecurity and anomaly-detection problems [3], [7]- [9]. In [3], we analyze and benchmark big-data-analytics frameworks for large-scale network-traffic monitoring and analysis.…”

Section: State Of the Artmentioning

confidence: 99%

“…In [3], we analyze and benchmark big-data-analytics frameworks for large-scale network-traffic monitoring and analysis. In [7], we compare the performance of standard, offline machinelearning models for network security in fixed-line networks, further studying more complex and robust models based on ensemble-machine-learning techniques. Wireless-network monitoring using similar techniques is studied in [9].…”

Section: State Of the Artmentioning

confidence: 99%

ADAM & RAL: Adaptive Memory Learning and Reinforcement Active Learning for Network Monitoring

Wassermann

Cuvelier

Mulinka

et al. 2019

2019 15th International Conference on Network and Service Management (CNSM)

Self Cite

View full text Add to dashboard Cite

Network-traffic data commonly arrives in the form of fast data streams; online network-monitoring systems continuously analyze these kinds of streams, sequentially collecting measurements over time. Continuous and dynamic learning is an effective learning strategy when operating in these fast and dynamic environments, where concept drifts constantly occur. In this paper, we propose different approaches for stream-based machine learning, able to analyze network-traffic streams on the fly, using supervised learning techniques. We address two major challenges associated to stream-based machine learning and online network monitoring: (i) how to dynamically learn from and adapt to non-stationary data and patterns changing over time, and (ii) how to deal with the limited availability of ground truth or labeled data to continuously tune a supervised learning model. We introduce ADAM & RAL, two stream-based machine-learning approaches to tackle these challenges. ADAM implements multiple stream-based machine-learning models and relies on an adaptive memory strategy to dynamically adapt the size of the system's learning memory to the most recent data distribution, triggering new learning steps when concept drifts are detected. RAL implements a stream-based active-learning strategy to reduce the amount of labeled data needed for streambased learning, dynamically deciding on the most informative samples to integrate into the continuous learning scheme. Using a reinforcement learning loop, RAL improves prediction performance by additionally learning from the goodness of its previous sample-selection decisions. We focus on a particularly challenging problem in network monitoring: continuously tuning detection models able to recognize network attacks over time. By continuously learning from and detecting concept drifts within real network measurements, we show that ADAM & RAL can continuously achieve high detection accuracy and limit the amount of training data needed to detect attacks over dynamic network data streams.

show abstract

“…It was conspicuous that all the algorithmic combinations with SVM produced better results than individual SVM [14]. e implementation of the ensemble learning algorithm called super learner resulted in improved predictions using the MAWILab dataset [15]. One such ensemble learning paradigm is stacking that considers several machine learning algorithms, uses a metamodel to combine predictions from individual algorithms, and thereby improves overall performance.…”

Section: Introductionmentioning

confidence: 99%

A Stacking Ensemble for Network Intrusion Detection Using Heterogeneous Datasets

Rajagopal

Kundapur

Hareesha

2020

Security and Communication Networks

153

View full text Add to dashboard Cite

The problem of network intrusion detection poses innumerable challenges to the research community, industry, and commercial sectors. Moreover, the persistent attacks occurring on the cyber-threat landscape compel researchers to devise robust approaches in order to address the recurring problem. Given the presence of massive network traffic, conventional machine learning algorithms when applied in the field of network intrusion detection are quite ineffective. Instead, a hybrid multimodel solution when sought improves performance thereby producing reliable predictions. Therefore, this article presents an ensemble model using metaclassification approach enabled by stacked generalization. Two contemporary as well as heterogeneous datasets, namely, UNSW NB-15, a packet-based dataset, and UGR’16, a flow-based dataset, that were captured in emulated as well as real network traffic environment, respectively, were used for experimentation. Empirical results indicate that the proposed stacking ensemble is capable of generating superior predictions with respect to a real-time dataset (97% accuracy) than an emulated one (94% accuracy).

show abstract

Ensemble-learning Approaches for Network Security and Anomaly Detection

Cited by 74 publications

References 9 publications

Anomaly detection for cellular networks using big data analytics

Anomaly detection for cellular networks using big data analytics

ADAM & RAL: Adaptive Memory Learning and Reinforcement Active Learning for Network Monitoring

A Stacking Ensemble for Network Intrusion Detection Using Heterogeneous Datasets

Contact Info

Product

Resources

About