Network Anomaly Detection by Using a Time-Decay Closed Frequent Pattern

Abstract

Anomaly detection of network traffic flows is a non-trivial problem in the field of network security due to the complexity of network traffic. However, most machine learning-based detection methods focus on network anomaly detection but ignore the user anomaly behavior detection. In real scenarios, the anomaly network behavior may harm the user interests. In this paper, we propose an anomaly detection model based on time-decay closed frequent patterns to address this problem. The model mines closed frequent patterns from the network traffic of each user and uses a time-decay factor to distinguish the weight of current and historical network traffic. Because of the dynamic nature of user network behavior, a detection model update strategy is provided in the anomaly detection framework. Additionally, the closed frequent patterns can provide interpretable explanations for anomalies. Experimental results show that the proposed method can detect user behavior anomaly, and the network anomaly detection performance achieved by the proposed method is similar to the state-of-the-art methods and significantly better than the baseline methods.

Intrusion detection systems for IoT: Opportunities and challenges offered by edge computing

“…When calculating the probability of an event occurring also the time is considered, and an alert is raised if an event is unlikely to have happened in a speci ic time. Zhao et al [15] exploited techniques to mine frequent patterns in network traf ic, and applied time-decay factors to differentiate between newer and older patterns. This strategy helps such IDSs to update its system baseline, making the IDS able to cope with the highly dynamic behavior of users.…”

Intrusion Detection Systems for IoT: opportunities and challenges offered by Edge Computing and Machine Learning

“…They used the Auto-Regressive (AR) process to model the data, and then performed a sequential hypothesis testing to determine the presence of an anomaly. Zhao et al [23] exploited techniques to mine frequent patterns in network traffic, and applied time-decay factors to differentiate between newer and older patterns. This strategy helps AIDS to update its system baseline, making the IDS to cope with highly dynamical behavior of users.…”