Network anomaly detection by using a time-decay closed frequent pattern
Article
Article Title | Network anomaly detection by using a time-decay closed frequent pattern |
---|---|
ERA Journal ID | 122861 |
Article Category | Article |
Authors | Zhao, Ying, Chen, Junjun, Wu, Di, Teng, Jian, Sharma, Nabin, Sajjanhar, Atul and Blumenstein, Michael |
Journal Title | Information (Basel) |
Journal Citation | 10 (8) |
Article Number | 262 |
Number of Pages | 18 |
Year | 2019 |
Publisher | MDPI AG |
Place of Publication | Switzerland |
ISSN | 2078-2489 |
Digital Object Identifier (DOI) | https://doi.org/10.3390/info10080262 |
Web Address (URL) | https://www.mdpi.com/2078-2489/10/8/262 |
Abstract | Anomaly detection of network traffic flows is a non-trivial problem in the field of network security due to the complexity of network traffic. However, most machine learning-based detection methods focus on network anomaly detection but ignore the user anomaly behavior detection. In real scenarios, the anomaly network behavior may harm the user interests. In this paper, we propose an anomaly detection model based on time-decay closed frequent patterns to address this problem. The model mines closed frequent patterns from the network traffic of each user and uses a time-decay factor to distinguish the weight of current and historical network traffic. Because of the dynamic nature of user network behavior, a detection model update strategy is provided in the anomaly detection framework. Additionally, the closed frequent patterns can provide interpretable explanations for anomalies. Experimental results show that the proposed method can detect user behavior anomaly, and the network anomaly detection performance achieved by the proposed method is similar to the state-of-the-art methods and significantly better than the baseline methods. |
Keywords | anomaly detection; frequent pattern; user behavior |
Contains Sensitive Content | Does not contain sensitive content |
ANZSRC Field of Research 2020 | 460609. Networking and communications |
4602. Artificial intelligence | |
4604. Cybersecurity and privacy | |
Byline Affiliations | Beijing University of Chemical Technology, China |
University of Technology Sydney | |
Deakin University |
https://research.usq.edu.au/item/z4y1y/network-anomaly-detection-by-using-a-time-decay-closed-frequent-pattern
Download files
28
total views12
total downloads2
views this month0
downloads this month