Fusion-based anomaly detection system using modified isolation forest for internet of things

The rapid advancement of smartphones, as well as their widespread use, has resulted in a significant increase in new security concerns. Malware’s covert techniques make signature-based anti-virus/anti-malware solutions difficult to detect. The features used in such solutions are extracted from static or dynamic analysis. In this paper, an Android malware detection system has been proposed. It consists of two main subsystems that work in parallel, one has been trained for benign labeled apps while the second one has been trained on malware labeled apps. Each subsystem is based on an ensemble approach that consists of OC-SVM, LOF, and modified isolation forest (M-iForest) classifiers. Each subsystem used three one-class classifiers to take the decision in each subsystem independently. Moreover, each subsystem used both features that are extracted from static and dynamic malware analysis. The evaluation has been conducted based on two An-droid malware benchmark datasets which are DREBIN and CICAndMal2017. The proposed system achieved the highest accuracy compared to other related techniques; The accuracy for the DREBIN dataset was 98.7%, and 95.67% F-Score, while the accuracy for CICAndMal2017 was 98.99% and F-Score of 96.82%.

show abstract

“…2. Using a modified version of the Isolation forest (M iForest)classifier to enhance the performance of classification [13]. 3.…”

Section: Contributions and Paper Organizationmentioning

confidence: 99%

“…In this paper, the modified version for the traditional isolation forest in [29] has been used [13]. The modification has been done by tuning the contamination parameter to enhance the performance of detection.…”

Section: Modified Isolation Forest M-iforestmentioning

confidence: 99%

Android Malware Detection System Based on Ensemble Learning

AbuAlghanam

Alazzam

Qatawneh

et al. 2023

Preprint

View full text Add to dashboard Cite

show abstract

“…Anomalies are instances with short average path lengths on the trees as they are less common and require fewer splits to separate them from regular observations. Despite being widely used for Network Intrusion Detection [32][33][34][35][36], Isolation Forests are prone to be impacted by outliers and instances that significantly differ from the rest of the data, leading to possible false positive or false negative results. The use of TTA should improve robustness by providing more points of view for each instance.…”

Section: Isolation Forest Anomaly Detectionmentioning

confidence: 99%

TTANAD: Test-Time Augmentation for Network Anomaly Detection

Cohen

Goldshlager

Shapira

et al. 2023

Entropy

View full text Add to dashboard Cite

Machine learning-based Network Intrusion Detection Systems (NIDS) are designed to protect networks by identifying anomalous behaviors or improper uses. In recent years, advanced attacks, such as those mimicking legitimate traffic, have been developed to avoid alerting such systems. Previous works mainly focused on improving the anomaly detector itself, whereas in this paper, we introduce a novel method, Test-Time Augmentation for Network Anomaly Detection (TTANAD), which utilizes test-time augmentation to enhance anomaly detection from the data side. TTANAD leverages the temporal characteristics of traffic data and produces temporal test-time augmentations on the monitored traffic data. This method aims to create additional points of view when examining network traffic during inference, making it suitable for a variety of anomaly detector algorithms. Our experimental results demonstrate that TTANAD outperforms the baseline in all benchmark datasets and with all examined anomaly detection algorithms, according to the Area Under the Receiver Operating Characteristic (AUC) metric.

show abstract

“…This method works a bit differently from the typical methods of clustering, which are consistently associated with unsupervised detection. Furthermore, IF was used in the past to handle anomaly detection problems that involve time series, similar to those evaluated herein (e.g., in [44,45]).…”

Section: Isolation Forestmentioning

confidence: 99%

Anomaly Detection of Consumption in Hotel Units: A Case Study Comparing Isolation Forest and Variational Autoencoder Algorithms

et al. 2022

View full text Add to dashboard Cite

Buildings are responsible for a high percentage of global energy consumption, and thus, the improvement of their efficiency can positively impact not only the costs to the companies they house, but also at a global level. One way to reduce that impact is to constantly monitor the consumption levels of these buildings and to quickly act when unjustified levels are detected. Currently, a variety of sensor networks can be deployed to constantly monitor many variables associated with these buildings, including distinct types of meters, air temperature, solar radiation, etc. However, as consumption is highly dependent on occupancy and environmental variables, the identification of anomalous consumption levels is a challenging task. This study focuses on the implementation of an intelligent system, capable of performing the early detection of anomalous sequences of values in consumption time series applied to distinct hotel unit meters. The development of the system was performed in several steps, which resulted in the implementation of several modules. An initial (i) Exploratory Data Analysis (EDA) phase was made to analyze the data, including the consumption datasets of electricity, water, and gas, obtained over several years. The results of the EDA were used to implement a (ii) data correction module, capable of dealing with the transmission losses and erroneous values identified during the EDA’s phase. Then, a (iii) comparative study was performed between a machine learning (ML) algorithm and a deep learning (DL) one, respectively, the isolation forest (IF) and a variational autoencoder (VAE). The study was made, taking into consideration a (iv) proposed performance metric for anomaly detection algorithms in unsupervised time series, also considering computational requirements and adaptability to different types of data. (v) The results show that the IF algorithm is a better solution for the presented problem, since it is easily adaptable to different sources of data, to different combinations of features, and has lower computational complexity. This allows its deployment without major computational requirements, high knowledge, and data history, whilst also being less prone to problems with missing data. As a global outcome, an architecture of a platform is proposed that encompasses the mentioned modules. The platform represents a running system, performing continuous detection and quickly alerting hotel managers about possible anomalous consumption levels, allowing them to take more timely measures to investigate and solve the associated causes.

show abstract

Fusion-based anomaly detection system using modified isolation forest for internet of things

Cited by 20 publications

References 41 publications

Android Malware Detection System Based on Ensemble Learning

Android Malware Detection System Based on Ensemble Learning

TTANAD: Test-Time Augmentation for Network Anomaly Detection

Anomaly Detection of Consumption in Hotel Units: A Case Study Comparing Isolation Forest and Variational Autoencoder Algorithms

Contact Info

Product

Resources

About