Unsupervised parsimonious cluster-based anomaly detection (PCAD)

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Scopus citations

Abstract

Group anomaly detection (AD), i.e. detection of clusters of anomalous samples in a test batch, with the samples in a given such cluster exhibiting a common pattern of atypicality (relative to a null model) has important applications to discovering unknown classes present in a test data batch and, equivalently, to zero-day threat detection in a security context. When the feature space is large, clusters may manifest anomalies on very small feature subsets, which is well-captured by the parsimonious mixture modelling (PMM) framework. Thus, we propose a generalized likelihood ratio test (GLRT-like) group AD framework, with PMMs used for both the null and the alternative hypothesis (that an anomalous cluster is present), and with the Bayesian Information Criterion (BIC) used to adjudicate between these hypotheses. We demonstrate our approach on network traffic data sets, detecting Zeus (web) bots and peer-to-peer traffic as zero-day activities. Our PCAD achieves substantially better detection results than a previous group AD method applied to this domain.

Original languageEnglish (US)
Title of host publication2018 IEEE International Workshop on Machine Learning for Signal Processing, MLSP 2018 - Proceedings
EditorsNelly Pustelnik, Zheng-Hua Tan, Zhanyu Ma, Jan Larsen
PublisherIEEE Computer Society
ISBN (Electronic)9781538654774
DOIs
StatePublished - Oct 31 2018
Event28th IEEE International Workshop on Machine Learning for Signal Processing, MLSP 2018 - Aalborg, Denmark
Duration: Sep 17 2018Sep 20 2018

Publication series

NameIEEE International Workshop on Machine Learning for Signal Processing, MLSP
Volume2018-September
ISSN (Print)2161-0363
ISSN (Electronic)2161-0371

Other

Other28th IEEE International Workshop on Machine Learning for Signal Processing, MLSP 2018
CountryDenmark
CityAalborg
Period9/17/189/20/18

    Fingerprint

All Science Journal Classification (ASJC) codes

  • Human-Computer Interaction
  • Signal Processing

Cite this

Miller, D. J., Kesidis, G., & Qiu, Z. (2018). Unsupervised parsimonious cluster-based anomaly detection (PCAD). In N. Pustelnik, Z-H. Tan, Z. Ma, & J. Larsen (Eds.), 2018 IEEE International Workshop on Machine Learning for Signal Processing, MLSP 2018 - Proceedings [8517014] (IEEE International Workshop on Machine Learning for Signal Processing, MLSP; Vol. 2018-September). IEEE Computer Society. https://doi.org/10.1109/MLSP.2018.8517014