Robust feature selection and robust PCA for internet traffic anomaly detection

Pascoal, Carlota; Oliveira, M. Rosário; Valadas, Rui; Filzmoser, Peter; Salvador, Paulo; Pacheco, Antònio

doi:10.1109/infcom.2012.6195548

Cited by 77 publications

(45 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The anomaly scores , and the two can be compared to derive an evaluation of the detection technique against the scenario represented by the dataset. In order to aid the visualization process of the dataset, we also present some of the anomaly-score tables visually as anomaly-score graphs (ASGs) 7 .…”

Section: Evaluation Methodsmentioning

confidence: 99%

“…Better performance is indicated by curves that tend to occupy the top left, as these imply that sensitivity can be decreased to eliminate more FPs without degrading the TPR. 7 An ASG displays a time series of outputs (anomaly scores) from a detector. Our particular ASGs are annotated with the periods during which attacks (GT = 1 in pink) and migration (IMI = 1 in pale green) occur.…”

Section: Evaluation Methodsmentioning

confidence: 99%

“…We measured the performance of two AD techniques (Principal Component Analysis (PCA) and K-means clustering) that have proven to be effective in past and current literature [6], [7], [8]. These techniques were evaluated in a controlled cloud testbed in which an attack (either denialof-service (DoS) or netscan) and a migration occur either simultaneously or separately, yielding metrics such as detection performance (i.e., true-positive rate; TPR) A broad observation is that the presence of migration affects the ability of both techniques to detect netscan more than DoS These outcomes, empower our argument that under certain attack-type and migration conditions, the number of attacks that are missed and false alarms generated by these techniques could render them unreliable and unusable respectively.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Assessing the impact of intra-cloud live migration on anomaly detection

Shirazi

Simpson

Marnerides

et al. 2014

2014 IEEE 3rd International Conference on Cloud Networking (CloudNet)

View full text Add to dashboard Cite

Abstract-Virtualized cloud environments have emerged as a necessity within modern unified ICT infrastructures and have established themselves as a reliable backbone for numerous alwayson services. 'Live' intra-cloud virtual-machine (VM) migration is a widely used technique for efficient resource management employed within modern cloud infrastructures. Despite the benefits of such functionality, there are still several security issues which have not yet been thoroughly assessed and quantified. We investigate the impact of live virtual-machine migration on stateof-the-art anomaly detection (AD) techniques (namely PCA and K-means), by evaluating live migration under various attack types and intensities. We find that the performance for both detectors degrades as shown by their Receiver Operating Characteristics (ROC) curves when intra-cloud live migration is initiated while VMs are under a netscan (NS) or a denial-of-service (DoS) attack.

show abstract

Section: Evaluation Methodsmentioning

confidence: 99%

Section: Evaluation Methodsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Assessing the impact of intra-cloud live migration on anomaly detection

Shirazi

Simpson

Marnerides

et al. 2014

2014 IEEE 3rd International Conference on Cloud Networking (CloudNet)

View full text Add to dashboard Cite

show abstract

“…This paper is one of the first to draw the attention to the fact that in dynamic environments and continuously changing large media repositories, robustness should be an important aspect of feature selection. Robust feature selection has been addressed in other domains, such as in internet traffic anomaly detection [41] and, especially, in bioinformatics. Several approaches have been suggested for the analysis of gene expression data obtained from microarray experiments [1,4], for example in [19,39,44,58].…”

Section: Performance Metricsmentioning

confidence: 99%

Unsupervised group feature selection for media classification

Zaharieva

Breiteneder

Hudec

2017

Int J Multimed Info Retr

View full text Add to dashboard Cite

The selection of an appropriate feature set is crucial for the efficient analysis of any media collection. In general, feature selection strongly depends on the data and commonly requires expert knowledge and previous experiments in related application scenarios. Current unsupervised feature selection methods usually ignore existing relationships among components of multi-dimensional features (group features) and operate on single feature components. In most applications, features carry little semantics. Thus, it is less relevant if a feature set consists of complete features or a selection of single feature components. However, in some domains, such as content-based audio retrieval, features are designed in a way that they, as a whole, have considerable semantic meaning. The disruption of a group feature in such application scenarios impedes the interpretability of the results. In this paper, we propose an unsupervised group feature selection algorithm based on canonical correlation analysis (CCA). Experiments with different audio and video classification scenarios demonstrate the outstanding performance of the proposed approach and its robustness across different datasets.

show abstract

“…This was only done for the regular applications given that illicit ones have few datastreams and small variability and would be completely eliminated from the dataset, even for such small trimming percentiles. Apart from that, and following the recommendations in (Pascoal et al 2012;Pascoal 2014), data was smoothed using a logarithm transformation (ln(x + 1), to overcome the existence of zeros). SPCA, estimated according with the four methods under study, was applied to this dataset and percentages of explained variance from the conventional and symbolic approach are summarized in Table 2.…”

Section: Analysis Of Internet Datamentioning

confidence: 99%

Extracting Information from Interval Data Using Symbolic Principal Component Analysis

Oliveira

Vilela

Pacheco

et al. 2017

AJS

Self Cite

View full text Add to dashboard Cite

We introduce generic definitions of symbolic variance and covariance for random interval-valued variables, that lead to a unified and insightful interpretation of four known symbolic principal component estimation methods: CPCA, VPCA, CIPCA, and SymCov-PCA. Moreover, we propose the use of truncated versions of symbolic principal components, that use a strict subset of the original symbolic variables, as a way to improve the interpretation of symbolic principal components. Furthermore, the analysis of a real dataset leads to a meaningful characterization of Internet traffic applications, while highligting similarities between the symbolic principal component estimation methods considered in the paper.

show abstract

Robust feature selection and robust PCA for internet traffic anomaly detection

Cited by 77 publications

References 24 publications

Assessing the impact of intra-cloud live migration on anomaly detection

Assessing the impact of intra-cloud live migration on anomaly detection

Unsupervised group feature selection for media classification

Extracting Information from Interval Data Using Symbolic Principal Component Analysis

Contact Info

Product

Resources

About