RADM:Real-Time Anomaly Detection in Multivariate Time Series Based on Bayesian Network

Ding, Nan; Gao, Huanbo; Bu, Hongyu; Ma, Haoxuan

doi:10.1109/smartiot.2018.00-13

Cited by 13 publications

(8 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…So any significant deviation from the assumption will cause a decrease in detection accuracy [36]. Some anomaly detection studies that use Bayesian networks include works by Reazul et al [37] and Ding et al [38].…”

Section: ) Bayes Network (Bn)mentioning

confidence: 99%

CICIDS-2017 Dataset Feature Analysis With Information Gain for Anomaly Detection

et al. 2020

View full text Add to dashboard Cite

Feature selection (FS) is one of the important tasks of data preprocessing in data analytics. The data with a large number of features will affect the computational complexity, increase a huge amount of resource usage and time consumption for data analytics. The objective of this study is to analyze relevant and significant features of huge network traffic to be used to improve the accuracy of traffic anomaly detection and to decrease its execution time. Information Gain is the most feature selection technique used in Intrusion Detection System (IDS) research. This study uses Information Gain, ranking and grouping the features according to the minimum weight values to select relevant and significant features, and then implements Random Forest (RF), Bayes Net (BN), Random Tree (RT), Naive Bayes (NB) and J48 classifier algorithms in experiments on CICIDS-2017 dataset. The experiment results show that the number of relevant and significant features yielded by Information Gain affects significantly the improvement of detection accuracy and execution time. Specifically, the Random Forest algorithm has the highest accuracy of 99.86% using the relevant selected features of 22, whereas the J48 classifier algorithm provides an accuracy of 99.87% using 52 relevant selected features with longer execution time.

show abstract

Section: ) Bayes Network (Bn)mentioning

confidence: 99%

CICIDS-2017 Dataset Feature Analysis With Information Gain for Anomaly Detection

et al. 2020

View full text Add to dashboard Cite

show abstract

“…On the general assumption of the behavior of the target system model, the precision of the method is determined, with any notable departure from it is likely to reduce precision in detection. Bayesian networks have been applied in a few anomaly detection studies [22] [25].…”

Section: Bayes Network (Bn)mentioning

confidence: 99%

A Hybrid Approach for the Analysis of Feature Selection using Information Gain and BAT Techniques on The Anomaly Detection

Gosu¹,

Priyadarsini²,

Motupalli³

2021

TURCOMAT

View full text Add to dashboard Cite

Every day, millions of people in many institutions communicate with each other on the Internet. The past two decades have witnessed unprecedented levels of Internet use by people around the world. Almost alongside these rapid developments in the internet space, an ever increasing incidence of attacks carried out on the internet has been consistently reported every minute. In such a difficult environment, Anomaly Detection Systems (ADS) play an important role in monitoring and analyzing daily internet activities for security breaches and threats. However, the analytical data routinely generated from computer networks are usually of enormous size and of little use. This creates a major challenge for ADSs, who must examine all the functionality of a certain dataset to identify intrusive patterns. The selection of features is an important factor in modeling anomaly-based intrusion detection systems. An irrelevant characteristic can lead to overfitting which in turn negatively affects the modeling power of classification algorithms. The objective of this study is to analyze and select the most discriminating input characteristics for the construction of efficient and computationally efficient schemes for an ADS. In the first step, a heuristic algorithm called IG-BA is proposed for dimensionality reduction by selecting the optimal subset based on the concept of entropy. Then, the relevant and meaningful features are selected, before implementing Number of Classifiers which includes: (1) An irrelevant feature can lead to overfitting which in turn negatively affects the modeling power of the classification algorithms. Experiment was done on CICIDS-2017 dataset by applying (1) Random Forest (RF), (2) Bayes Network (BN), (3) Naive Bayes (NB), (4) J48 and (5) Random Tree (RT) with results showing better detection precision and faster execution time. The proposed heuristic algorithm outperforms the existing ones as it is more accurate in detection as well as faster. However, Random Forest algorithm emerges as the best classifier for feature selection technique and scores over others by virtue of its accuracy in optimal selection of features.

show abstract

“…Multivariate time series (MTS) is ubiquitous in an extensive range of real-world applications, such as weather forecast [1], health care [2,11], finance [3], manufacturing [9] and Cyber-Physical Systems [4,5,7,12]. Anomaly detection seeks outliers or suspicious observations which differ significantly from the majority of the data.…”

Section: Introductionmentioning

confidence: 99%

“…Anomaly detection seeks outliers or suspicious observations which differ significantly from the majority of the data. The difference between anomalous and non-anomalous data can be quantified by a variety of metrics such as Euclidean distance [14], mean squared error [9], correlation [15], cosine similarity [16], or dynamic time warping [17] between two observations, or the probability that an observation is drawn from a certain distribution [5,6] or it falls in a domain derived from that distribution [18]. Although there are numerous methods to tackle the problem from distinct angles, all methods can be decomposed to two steps: (1) derive a new sequence from the original MTS using a transformation or a predictive model; (2) calculate the "difference" metric for each element in the new sequence.…”

Section: Introductionmentioning

confidence: 99%

“…Although there are numerous methods to tackle the problem from distinct angles, all methods can be decomposed to two steps: (1) derive a new sequence from the original MTS using a transformation or a predictive model; (2) calculate the "difference" metric for each element in the new sequence. In step one, either a direct transformation from MTS to univariate time series (UTS), such as fuzzy integral [6], PCA [19] or subspace monitoring [20] can be applied, or a predictive model, such as generative adversarial network [7], long-short term memory [9], convolutional neural network [11], hierarchical temporal memory [5] and vector auto-regressive model [12]. In step two, either a self-defined threshold [7,9] is used to find anomalies if a predictive model was used, or an algorithm designed for anomaly detection in UTS or MTS cross-sectional data [8] is applied to the new sequence, for example, hidden Markov model [6], Bayes network [5], k-nearest neighbors algorithm [12], and one-class support vector machine [21] and ad-hoc decomposition [2,4].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Online Anomaly Detection for Smartphone-Based Multivariate Behavioral Time Series Data

Liu¹,

Onnela²

2022

Preprint

View full text Add to dashboard Cite

To detect aberrant human behaviors from large volume of passive data collected by smartphones in real time, we propose an online anomaly detection method using Hotelling’s T-squared test. The test statistic is a weighted average, with more weight on the between-individual component when there are little data available for the individual and more weight on the within-individual component when the data are adequate. The algorithm takes only O(1) run time in each update and the required memory usage is fixed after a pre-specified number of updates. The performance of the proposed method, in terms of accuracy, sensitivity and specificity, is consistently better than or equal to the offline method that it builds upon depending on the sample size of the individual data.

show abstract

RADM:Real-Time Anomaly Detection in Multivariate Time Series Based on Bayesian Network

Cited by 13 publications

References 3 publications

CICIDS-2017 Dataset Feature Analysis With Information Gain for Anomaly Detection

CICIDS-2017 Dataset Feature Analysis With Information Gain for Anomaly Detection

A Hybrid Approach for the Analysis of Feature Selection using Information Gain and BAT Techniques on The Anomaly Detection

Online Anomaly Detection for Smartphone-Based Multivariate Behavioral Time Series Data

Contact Info

Product

Resources

About