Hierarchical Attention-Based Anomaly Detection Model for Embedded Operating Systems

Ezeme, Okwudili M.; Mahmoud, Qusay H.; Azim, Akramul

doi:10.1109/rtcsa.2018.00035

Cited by 20 publications

(13 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…With the development in deep learning techniques, Ezeme et al introduced a hierarchical attention-based anomaly detection (HAbAD) model based on stacked Long Short-Term Memory (LSTM) Networks with Attention [9]. Yahyaoui et al proposed a detection protocol that dynamically executes the on-demand Support Vector Machine (SVM) classifier in a hierarchical way whenever an intrusion is suspected [10].…”

Section: Related Workmentioning

confidence: 99%

HADIoT: A Hierarchical Anomaly Detection Framework for IoT

2020

View full text Add to dashboard Cite

The Internet of Things establishes the intimacy between the Internet and the physical world. Due to portable size, most IoT devices have limited computing and storage capabilities and are vulnerable to various malicious intrusions. Therefore, it is vital to have efficient approaches to distinguish the true IoT data from fake one, we term such methods as anomaly detection (AD). To detect anomalies accurately and efficiently, in this paper a 3-hierarchy joint local and global anomaly detection framework, HADIoT, is proposed, in which IoT devices generate and transmit sensory data to their local edge servers for local AD after data refinement which includes re-framing, normalization, complexity reduction via Principal Component Analysis, and symbol mapping. High detection accuracy is achieved by jointly local and global ADs. The local AD focuses on the data pattern consistency of individual devices via the Gated Recurrent Unit, and the processed data is then forwarded from edge servers to the cloud server for global AD. The global AD focuses on the analysis of the data pattern correlations between different IoT devices, using the Conditional Random Fields. For the maintenance of cyber-security, the proposed anomaly detection framework HADIoT enables to provide an accurate and faster anomaly detection for IoT applications, compared with existing anomaly detection methods. The performance of the proposed method is also empirically evaluated through simulations, using a real dataset-the Information Security Center of Excellence (ISCX) 2012 dataset. Simulation results demonstrate the effectiveness of the proposed framework in terms of True Positive Rate, False Positive Rate, Precision, Accuracy and F_score, compared with three benchmark schemes.

show abstract

Section: Related Workmentioning

confidence: 99%

HADIoT: A Hierarchical Anomaly Detection Framework for IoT

2020

View full text Add to dashboard Cite

show abstract

“…Still, they do not consider the temporal relationship amongst the sequence of the system calls. Also, in [17], [18], the hierarchical LSTM network is used to explore the understanding of relationships amongst the kernel event traces of an embedded system, but other features that ordinarily should yield a more representative model like timestamps, CPU cycles, and system call arguments are skipped.…”

Section: Related Workmentioning

confidence: 99%

Design and Development of AD-CGAN: Conditional Generative Adversarial Networks for Anomaly Detection

2020

Self Cite

View full text Add to dashboard Cite

Whether in the realm of software or hardware, datasets representing the state of systems are mostly imbalanced. This imbalance is because these systems' reliability requirements make the occurrence of an anomaly a rare phenomenon. Hence, most datasets on anomaly detection have a relatively small percentage that captures the anomaly. Recently, generative adversarial networks (GAN) have shown promising results in image generation tasks. Therefore, in this research work, we build on conditional GANs (CGAN) to generate plausible distributions of a given profile to solve the challenge of data imbalance in anomaly detection tasks and present a novel framework for anomaly detection. Firstly, we learn the pattern of the minority class data samples using a single class CGAN. Secondly, we use the knowledge base of the single class CGAN to generate samples that augment the minority class samples so that a binary class CGAN can train on the typical and malicious profiles with a balanced dataset. This approach inherently eliminates the bias imposed on algorithms from the dataset and results in a robust framework with improved generalization. Thirdly, the binary class CGAN generates a knowledge base that we use to construct the cluster-based anomaly detector. During testing, we do not use the single class CGAN, thereby providing us with a lean and efficient algorithm for anomaly detection that can do anomaly detection on semisupervised and non-parametric multivariate data. We test the framework on logs and image-based anomaly detection datasets with class imbalance. We compare the performance of AD-CGAN with GAN-derived and non-GAN-derived state of the art algorithms on benchmark datasets. AD-CGAN outperforms most of the algorithms in the standard metrics of Precision, Recall, and F-1 Score. Where AD-CGAN does not perform better in the parameters used, it has the advantage of being lightweight. Therefore, it can be deployed for both online and offline anomaly detection tasks since it does not use an input sample inversion strategy.

show abstract

“…Ezeme et al [9], [13], Salem et al [18] [9], [13], [18] have used the same dataset for model validation. Although [9], [18] models are offline-based models and do not take temporal relationships in the sequence of events into account, we compare DReAM with theirs as those are the works we know targeting anomaly detection in an embedded system via trace analysis that have used the same dataset for model validation.…”

Section: B Dream Vs Other Modelsmentioning

confidence: 99%

“…Although [9], [18] models are offline-based models and do not take temporal relationships in the sequence of events into account, we compare DReAM with theirs as those are the works we know targeting anomaly detection in an embedded system via trace analysis that have used the same dataset for model validation. We also include the HAbAD model of [13] in the comparison as this work builds on its architecture to reduce the high incidences of the false positive rate recorded in the HAbAD model. Table 3 displays the true and false positive rates from those works compared to DReAM.…”

Section: B Dream Vs Other Modelsmentioning

confidence: 99%

“…The logic in our reasoning is that just like natural language, each tuple has different contexts based on usage and the effect of the present tuple V t on next prediction V t+1 should come from a more in-depth and more extended context than just the current attention vector Z t . Therefore, in furtherance of the idea espoused by [13] in their Hierarchical Attention-based Anomaly Detection model called HAbAD, we introduce a new model architecture that is more robust to the incidents of false positives. Technically, DReAM is different from the model of HAbAD based on how the context vector is constructed and used in both the attention layer and next target prediction and this is one of the principal technical contributions of the work.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

DReAM: Deep Recursive Attentive Model for Anomaly Detection in Kernel Events

2019

Self Cite

View full text Add to dashboard Cite

System logs and traces contain information that reflects the state of the system and serves as a rich source of knowledge for system monitoring from the application to the kernel layer. Moreover, logging of traces as a tool for monitoring the operation of a cyber-physical system is recommended by most safety standard organizations. However, because the data can be overwhelmingly huge within a short space of time, the use of models that do not rely only on known signatures for online anomaly detection becomes difficult to use due to the challenge of processing such an enormous amount of data at runtime. Hence, most practitioners resort to the use of signature-based tools. In this paper, we introduce an anomaly detection model that uses intra-trace and inter-trace context vectors with long short-term memory networks to overcome the challenge of online anomaly detection in cyber-physical systems. We test the performance of the model with publicly available datasets that reflect the internal and external control flow of an embedded application and our model demonstrates both the effectiveness and robustness in detecting an anomalous sequence in a system call stream.INDEX TERMS Anomaly detection, kernel events, embedded system, machine learning.

show abstract

Hierarchical Attention-Based Anomaly Detection Model for Embedded Operating Systems

Cited by 20 publications

References 15 publications

HADIoT: A Hierarchical Anomaly Detection Framework for IoT

HADIoT: A Hierarchical Anomaly Detection Framework for IoT

Design and Development of AD-CGAN: Conditional Generative Adversarial Networks for Anomaly Detection

DReAM: Deep Recursive Attentive Model for Anomaly Detection in Kernel Events

Contact Info

Product

Resources

About