DMCA
Temporal sequence learning and data reduction for anomaly detection (1999)
Cached
Download Links
| Venue: | ACM TRANSACTIONS ON INFORMATION SYSTEMS SECURITY |
| Citations: | 191 - 6 self |
BibTeX
@ARTICLE{Lane99temporalsequence,
author = {Terran Lane and Carla E. Brodley},
title = {Temporal sequence learning and data reduction for anomaly detection},
journal = {ACM TRANSACTIONS ON INFORMATION SYSTEMS SECURITY},
year = {1999},
pages = {295}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
The anomaly detection problem can be formulated as one of learning to characterize the behaviors of an individual, system, or network in terms of temporal sequences of discrete data. We present an approach to this problem based on instance based learning (IBL) techniques. To cast the anomaly detection task in an IBL framework, we employ an approach that transforms temporal sequences of discrete, unordered observations into a metric space via a similarity measure that encodes intra-attribute dependencies. Classification boundaries are selected from an a posteriori characterization of the valid user's behaviors, coupled with a domain heuristic. An empirical evaluation of the approach on user command data demonstrates that we can accurately differentiate the profiled user from alternative users when the available features encode sufficient information. Furthermore, we demonstrate that the system detects anomalous conditions quickly -- an important quality for reducing potential damage by a malicious user. We present several techniques for reducing the data storage requirements of the user profile, including instance selection methods and clustering. An empirical evaluation shows that a new greedy clustering algorithm reduces the size of the user model by 70 % with only a small loss in accuracy. A comparison of the greedy clustering technique to clustering with K-centers shows that greedy clustering is preferable in terms of accuracy and computation time for this domain.
Keyphrases
data reduction anomaly detection temporal sequence learning temporal sequence greedy clustering posteriori characterization discrete data malicious user sufficient information user profile present several technique new greedy algorithm reduces anomaly detection problem user command data metric space anomaly detection task anomalous condition alternative user important quality potential damage classification boundary intra-attribute dependency computation time data storage requirement k-centers show ibl framework similarity measure unordered observation instance selection method empirical evaluation show user model available feature valid user small loss empirical evaluation
