ZERO++: Harnessing the Power of Zero Appearances to Detect Anomalies in Large-Scale Data Sets

Pang, Guansong; Ting, Kai Ming; Albrecht, David; Jin, Huidong

doi:10.1613/jair.5228

Cited by 18 publications

(12 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Embedding-based representation, which is the most widely used in categorical data representation, generates a numerical vector to represent each categorical object. A popular embedding method called 1-hot encoding translates each feature value to a zero-one indicator vector [ 6 ]. It first counts the values of one feature

.…”

Section: Related Workmentioning

confidence: 99%

“…Generally, existing methods fall into two categories: the embedding-based method and the similarity-based method. Typical embedding methods, e.g., 1-hot encoding and Inverse Document Frequency (IDF) encoding [ 6 , 7 ], transform categorical data to numerical data by some encoding schemes directly. But these methods treat features independently and ignore the couplings between feature values.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

CDE++: Learning Categorical Data Embedding by Enhancing Heterogeneous Feature Value Coupling Relationships

Dong

Jian

Zuo

2020

Entropy

View full text Add to dashboard Cite

Categorical data are ubiquitous in machine learning tasks, and the representation of categorical data plays an important role in the learning performance. The heterogeneous coupling relationships between features and feature values reflect the characteristics of the real-world categorical data which need to be captured in the representations. The paper proposes an enhanced categorical data embedding method, i.e., CDE++, which captures the heterogeneous feature value coupling relationships into the representations. Based on information theory and the hierarchical couplings defined in our previous work CDE (Categorical Data Embedding by learning hierarchical value coupling), CDE++ adopts mutual information and margin entropy to capture feature couplings and designs a hybrid clustering strategy to capture multiple types of feature value clusters. Moreover, Autoencoder is used to learn non-linear couplings between features and value clusters. The categorical data embeddings generated by CDE++ are low-dimensional numerical vectors which are directly applied to clustering and classification and achieve the best performance comparing with other categorical representation learning methods. Parameter sensitivity and scalability tests are also conducted to demonstrate the superiority of CDE++.

show abstract

.…”

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

CDE++: Learning Categorical Data Embedding by Enhancing Heterogeneous Feature Value Coupling Relationships

Dong

Jian

Zuo

2020

Entropy

View full text Add to dashboard Cite

show abstract

“…COSH uses the multi-granularity value clusters to compute the most outlying aspect of values, which enables it to obtain reliable outlier scores in data sets with many irrelevant/noisy features. Substantial experiments show that (1) CDE significantly outperforms three popular embedding methods: one-hot encoding (noted as 0-1), one-hot encoding with PCA (0-1P), and inverse document frequency embedding (IDF), with maximum F-score improvement of 19%, and gains maximally 8% F-score improvement over three state-of-the-art similarity measures for clustering: COS [1], DILCA [8] and ALGO [7] on 10 real-world data sets with different value coupling complexities; (2) COSH significantly outperforms (maximally 67% AUC improvement) five state-of-the-art outlier detection methods: CBRW [14], and ZERO [15], iForest [16], ABOD [17] and LOF [18] on 10 high-dimensional data sets; (3) CDE and COSH obtain good scalability: it is linear to data size and quadratic to the number of features; and (4) CDE and COSH perform stably and are insensitive to its parameters.…”

Section: Contributionsmentioning

confidence: 99%

CURE: Flexible Categorical Data Representation by Hierarchical Coupling Learning

Jian

Pang

Cao

et al. 2019

IEEE Trans. Knowl. Data Eng.

Self Cite

View full text Add to dashboard Cite

The representation of categorical data with hierarchical coupling relationships (i.e., value to value cluster interactions) is very critical yet challenging for capturing data characteristics in learning tasks. This paper proposes a novel and flexible coupled unsupervised categorical data representation (CURE) framework which not only captures the hierarchical couplings but also is flexible to be instantiated for contrastive learning tasks. CURE first learns value clusters with different granularities based on multiple value coupling functions and then learns value representation from the couplings between the obtained value clusters. Based on two complementary value coupling functions, CURE is instantiated into two instances: the coupled data embedding (CDE) for clustering and the coupled outlier scoring of high-dimensional data (COSH) for outlier detection, by customizing the ways of value clustering and coupling learning between value clusters. CDE embeds categorical data into a new space in which features are independent and semantics are rich. COSH represents data with an outlying vector to capture complex outlying behaviors of objects in high-dimensional data. Substantial experiments show that CDE significantly outperforms three popular unsupervised embedding methods (with maximum 19% improvement) and three state-of-the-art similarity-based representation methods (maximum improvement of 8%), and COSH performs significantly better than five state-of-the-art outlier detection methods (with 67% maximum improvement) on high-dimensional data sets. CDE and COSH are scalable and stable, linear to data size and quadratic to the number of features, and are insensitive to their parameters.

show abstract

“…At the beginning of the 1990, a number of IDSs were developed, mostly relying on a combination of statistical and expert systems approaches [14]. According to [15] the processing is more statistically sophisticated and simple -real-time alerts became possible. The use of competitive neural networks in researches related to intrusion detection in computer networks is present in a number of studies [16].…”

Section: Related Workmentioning

confidence: 99%

“…where the dominant role is on those other techniques [32], [25], but very often they use fuzzy logic or SOM for additional fine tuning [15]. Common for all previously mentioned researches is the use of techniques of the artificial intelligence, where the systems based on the application of neural networks with competitive learning [33] and fuzzy logic play an important role.…”

Section: Related Workmentioning

confidence: 99%

Intrusion Detection System Modeling Based on Learning from Network Traffic Data

2018

TIIS

View full text Add to dashboard Cite

This research uses artificial intelligence methods for computer network intrusion detection system modeling. Primary classification is done using self-organized maps (SOM) in two levels, while the secondary classification of ambiguous data is done using Sugeno type Fuzzy Inference System (FIS). FIS is created by using Adaptive Neuro-Fuzzy Inference System (ANFIS). The main challenge for this system was to successfully detect attacks that are either unknown or that are represented by very small percentage of samples in training dataset. Improved algorithm for SOMs in second layer and for the FIS creation is developed for this purpose. Number of clusters in the second SOM layer is optimized by using our improved algorithm to minimize amount of ambiguous data forwarded to FIS. FIS is created using ANFIS that was built on ambiguous training dataset clustered by another SOM (which size is determined dynamically). Proposed hybrid model is created and tested using NSL KDD dataset. For our research, NSL KDD is especially interesting in terms of class distribution (overlapping). Objectives of this research were: to successfully detect intrusions represented in data with small percentage of the total traffic during early detection stages, to successfully deal with overlapping data (separate ambiguous data), to maximize detection rate (DR) and minimize false alarm rate (FAR). Proposed hybrid model with test data achieved acceptable DR value 0.8883 and FAR value 0.2415. The objectives were successfully achieved as it is presented (compared with the similar researches on NSL KDD dataset). Proposed model can be used not only in further research related to this domain, but also in other research areas. had shortcomings. They are resolved in the architecture proposed in this manuscript. The main improvement is related to optimization in the second SOM layer using an improved algorithm while keeping acceptable level of DR and FAR. Furthermore, the amount of ambiguous traffic samples that are forwarded to FIS for further analysis is minimized.

show abstract

ZERO++: Harnessing the Power of Zero Appearances to Detect Anomalies in Large-Scale Data Sets

Cited by 18 publications

References 34 publications

CDE++: Learning Categorical Data Embedding by Enhancing Heterogeneous Feature Value Coupling Relationships

CDE++: Learning Categorical Data Embedding by Enhancing Heterogeneous Feature Value Coupling Relationships

CURE: Flexible Categorical Data Representation by Hierarchical Coupling Learning

Intrusion Detection System Modeling Based on Learning from Network Traffic Data

Contact Info

Product

Resources

About