ICDF: Intrusion collaborative detection framework based on confidence

Zhi, Wang; Shao, Leshi; Cheng, Kai; Liu, Yuanzhao; Jiang, Jianan; Nie, Yuanping; Li, Xiang; Kuang, Xiaohui

doi:10.1002/int.22877

Cited by 6 publications

(6 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Te proposed method also can detect botnets in an online manner based a new anomaly scoring function representing the maliciousness of network connections. Similar to this work, Wang et al [32] introduced an intrusion collaborative detection framework based on confdence.…”

Section: Related Workmentioning

confidence: 85%

“…Compared with traditional machine learning methods, automatic feature extraction methods have a deeper level of learning ability. Terefore, these approaches have a wide range of application scenarios in industry or academia, such as machinery fault diagnosis [27][28][29], network stream detection [30], botnet detection [31], and intrusion collaborative detection [32]. As mentioned in these references, the automatic feature extraction methods always adopt neural networks to extract features.…”

Section: Related Workmentioning

confidence: 99%

“…Using deep learning to extract features is advantageous because it can control the number of hidden layer nodes to a polynomial multiple of the number of input nodes instead of presenting an exponential multiple and has strong expressive power. Compared with these deep learning frameworks (such as [30][31][32]), DETD has great advantages in feature extraction. We can observe that local features for these deep learning methods are better than global features in the problem of encryption trafc anomaly detection.…”

Section: Comparison With State-of-the-artmentioning

confidence: 99%

See 2 more Smart Citations

Deep Encrypted Traffic Detection: An Anomaly Detection Framework for Encryption Traffic Based on Parallel Automatic Feature Extraction

Long

Zhang

2023

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

With an increasing number of network attacks using encrypted communication, the anomaly detection of encryption traffic is of great importance to ensure reliable network operation. However, the existing feature extraction methods for encrypted traffic anomaly detection have difficulties in extracting features, resulting in their low efficiency. In this paper, we propose a framework of encrypted traffic anomaly detection based on parallel automatic feature extraction, called deep encrypted traffic detection (DETD). The proposed DETD uses a parallel small-scale multilayer stack autoencoder to extract local traffic features from encrypted traffic and then adopts an L1 regularization-based feature selection algorithm to select the most representative feature set for the final encrypted traffic anomaly detection task. The experimental results show that DETD has promising robustness in feature extraction, i.e., the feature extraction efficiency of DETD is 66% higher than that of the conventional stacked autoencoder, and the anomaly detection performance is as high as 99.998%, and thus DETD outperforms the deep full-range framework and other neural network anomaly detection algorithms.

show abstract

Section: Related Workmentioning

confidence: 85%

Section: Related Workmentioning

confidence: 99%

Section: Comparison With State-of-the-artmentioning

confidence: 99%

See 1 more Smart Citation

Deep Encrypted Traffic Detection: An Anomaly Detection Framework for Encryption Traffic Based on Parallel Automatic Feature Extraction

Long

Zhang

2023

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

show abstract

“…By identifying outliers, researchers can obtain vital knowledge that assists in making better decisions or avoiding risks. Thus, outlier detection is widely used in many fields, such as fraud detection [2][3][4][5][6], intelligent transportation [7][8][9][10], video content analysis and detection [11][12][13], network intrusion detection and IoT security [14][15][16][17][18][19][20], data generation [21,22], and social media analysis [23][24][25][26].…”

Section: Introductionmentioning

confidence: 99%

MGAD: Mutual Information and Graph Embedding Based Anomaly Detection in Multivariate Time Series

Huang,

Liu,

et al. 2024

Electronics

View full text Add to dashboard Cite

Along with the popularity of mobile Internet and smart applications, more and more high-dimensional sensor data have appeared, and these high-dimensional sensor data have hidden information about system performance degradation, system failure, etc., and how to mine them to obtain such information is a very difficult problem. This challenge can be solved by anomaly detection techniques, which is an important field of research in data mining, especially in the domains of network security, credit card fraud detection, industrial fault identification, etc. However, there are many difficulties in anomaly detection in multivariate time-series data, including poor accuracy, fast data generation, lack of labeled data, and how to capture information between sensors. To address these issues, we present a mutual information and graph embedding based anomaly detection algorithm in multivariate time series, called MGAD (mutual information and graph embedding based anomaly detection). The MGAD algorithm consists of four steps: (1) Embedding of sensor data, where heterogeneous sensor data become different vectors in the same vector space; (2) Constructing a relationship graph between sensors using their mutual information about each other; (3) Learning the relationship graph between sensors using a graph attention mechanism, to predict the sensor data at the next moment; (4) Compare the predicted values with the real sensor data to detect potential outliers. Our contributions are as follows: (1) we propose an unsupervised outlier detection called MGAD with a high interpretability and accuracy; (2) massive experiments on benchmark datasets have demonstrated the superior performance of the MGAD algorithm, compared with state-of-the-art baselines in terms of ROC, F1, and AP.

show abstract

“…By identifying outliers, researchers can obtain vital knowledge that assists in making better decisions or avoiding risks. So, outlier detection is widely used in many fields, such as network intrusion detection [2][3][4][5], intelligent transportation [6][7][8][9], video content analysis and detection [10][11][12], fraud detection [13][14][15], social media analysis [16][17][18][19], and data generation [20,21].…”

Section: Introductionmentioning

confidence: 99%

Interpretable Single-dimension Outlier Detection (ISOD): An Unsupervised Outlier Detection Method Based on Quantiles and Skewness Coefficients

Huang,

Liu,

et al. 2023

Applied Sciences

View full text Add to dashboard Cite

A crucial area of study in data mining is outlier detection, particularly in the areas of network security, credit card fraud detection, industrial flaw detection, etc. Existing outlier detection algorithms, which can be divided into supervised methods, semi-supervised methods, and unsupervised methods, suffer from missing labeled data, the curse of dimensionality, low interpretability, etc. To address these issues, in this paper, we present an unsupervised outlier detection method based on quantiles and skewness coefficients called ISOD (Interpretable Single dimension Outlier Detection). ISOD first fulfils the empirical cumulative distribution function before computing the quantile and skewness coefficients of each dimension. Finally, it outputs the outlier score. This paper’s contributions are as follows: (1) we propose an unsupervised outlier detection algorithm called ISOD, which has high interpretability and scalability; (2) massive experiments on benchmark datasets demonstrated the superior performance of the ISOD algorithm compared with state-of-the-art baselines in terms of ROC and AP.

show abstract

ICDF: Intrusion collaborative detection framework based on confidence

Abstract: Many machine-learning-based intrusion detection methods have been proposed, however there is a lack of collaboration among these methods.

Cited by 6 publications

References 32 publications

Deep Encrypted Traffic Detection: An Anomaly Detection Framework for Encryption Traffic Based on Parallel Automatic Feature Extraction

Deep Encrypted Traffic Detection: An Anomaly Detection Framework for Encryption Traffic Based on Parallel Automatic Feature Extraction

MGAD: Mutual Information and Graph Embedding Based Anomaly Detection in Multivariate Time Series

Interpretable Single-dimension Outlier Detection (ISOD): An Unsupervised Outlier Detection Method Based on Quantiles and Skewness Coefficients

Contact Info

Product

Resources

About