Semantic-Driven Model Composition for Accurate Anomaly Diagnosis

Ghanbari, Shamsollah; Amza, Cristiana

doi:10.1109/icac.2008.33

Cited by 17 publications

(8 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The classifier is learned via supervised learning by annotating sets of system metric values with failure states. Ghanbari and Amza [9] combine models for anomaly detection on individual components together into a single belief network, modelling the structure and causal relationships of components. Learning based on observing injected faults is performed to refine the model and the probabilities associated with the causal relationships.…”

Section: Related Workmentioning

confidence: 99%

Mapping Policies to a Causal Network for Diagnosis

Tighe

Bauer

2010

2010 Sixth International Conference on Autonomic and Autonomous Systems

View full text Add to dashboard Cite

Policy-based Autonomic Management monitors a system and its applications and tweaks performance parameters in real-time based on a set of governing policies. A policy specifies a set of conditions under which one or more of a set of actions are to be performed. It is common that multiple policies' conditions are met simultaneously, each advocating actions. We propose a method of diagnosing the system to try to determine the best action or actions to perform in a given situation using Abductive Inference. We develop an original method of building a causality graph to facilitate diagnosis directly from a set of policies. Performance of the diagnosis method is measured by implementing diagnosis into an existing autonomic management application. The results are favourable when compared to previous methods of action selection.

show abstract

Section: Related Workmentioning

confidence: 99%

Mapping Policies to a Causal Network for Diagnosis

Tighe

Bauer

2010

2010 Sixth International Conference on Autonomic and Autonomous Systems

View full text Add to dashboard Cite

show abstract

“…It requires a pre-classified training data set and don't dynamically adapt system to the changing conditions. Ghanbari and Amza [23] train belief networks that represent complex systems by injecting failures. At the outset, experts model a belief network that describes the dependencies within a system.…”

Section: Related Workmentioning

confidence: 99%

Runtime Monitoring and Dynamic Reconfiguration for Intrusion Detection Systems

Řehák

Staab

Fusenig

et al. 2009

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Our work proposes a generic architecture for runtime monitoring and optimization of IDS based on the challenge insertion. The challenges, known instances of malicious or legitimate behavior, are inserted into the network traffic represented by NetFlow records, processed with the current traffic and the system's response to the challenges is used to determine its effectiveness and to fine-tune its parameters. The insertion of challenges is based on the threat models expressed as attack trees with attached risk/loss values. The use of threat model allows the system to measure the expected undetected loss and to improve its performance with respect to the relevant threats, as we have verified in the experiments performed on live network traffic.

show abstract

“…Typically, supervised learning is used such that any recurrent faults can be identified quickly if they were to occur again. Such methods [10], [11], [12] use either Bayesian or neural networks to learn fault symptoms from labeled data. While such efforts significantly improve diagnosis, they suffer from the important drawback that prior fault knowledge is required to diagnose a fault successfully.…”

Section: Fault Diagnosismentioning

confidence: 99%

Efficient Fault Detection and Diagnosis in Complex Software Systems with Information-Theoretic Monitoring

Jiang

Munawar

Reidemeister

et al. 2011

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Management metrics of complex software systems exhibit stable correlations which can enable fault detection and diagnosis. Current approaches use specific analytic forms, typically linear, for modeling correlations. In practice, more complex nonlinear relationships exist between metrics. Moreover, most intermetric correlations form clusters rather than simple pairwise correlations. These clusters provide additional information and offer the possibility for optimization. In this paper, we address these issues by using Normalized Mutual Information (NMI) as a similarity measure to identify clusters of correlated metrics, without assuming any specific form for the metric relationships. We show how to apply the Wilcoxon Rank-Sum test on the entropy measures to detect errors in the system. We also present three diagnosis algorithms to locate faulty components: RatioScore, based on the Jaccard coefficient, SigScore, which incorporates knowledge of component dependencies, and BayesianScore, which uses Bayesian inference to assign a fault probability to each component. We evaluate our approach in the context of a complex enterprise application, and show that 1) stable, nonlinear correlations exist and can be captured with our approach; 2) we can detect a large fraction of faults with a low false positive rate (we detect up to 18 of the 22 faults we injected); and 3) we improve the diagnosis with our new diagnosis algorithms.

show abstract

Semantic-Driven Model Composition for Accurate Anomaly Diagnosis

Abstract: In this paper, we introduce a semantic-driven approach to system modeling for improving the accuracy of anomaly diagnosis.

Cited by 17 publications

References 14 publications

Mapping Policies to a Causal Network for Diagnosis

Mapping Policies to a Causal Network for Diagnosis

Runtime Monitoring and Dynamic Reconfiguration for Intrusion Detection Systems

Efficient Fault Detection and Diagnosis in Complex Software Systems with Information-Theoretic Monitoring

Contact Info

Product

Resources

About