Abstract:The intrusion detection in computer networks is a complex research problem, which requires the understanding of computer networks and the mechanism of intrusions, the configuration of sensors and the collected data, the selection of the relevant attributes, and the monitor algorithms for online detection. It is critical to develop general methods for data dimension reduction, effective monitoring algorithms for intrusion detection, and means for their performance improvement. This dissertation is motivated by the timely need to develop statistics-based machine learning methods for effective detection of computer network anomalies. Three fundamental research issues related to data dimension reduction, control charts design and performance improvement have been addressed accordingly. The major research activities and corresponding contributions are summarized as follows: (1) Filter and Wrapper models are integrated to extract a small number of the informative attributes for computer network intrusion detection. A two-phase analyses method is proposed for the integration of Filter and Wrapper models. The proposed method has successfully reduced the original 41 attributes to 12 informative attributes while increasing the accuracy of the model. The comparison of the results in each phase shows the effectiveness of the proposed method. (2) Supervised kernel based control charts for anomaly intrusion detection. We propose to construct control charts in a feature space. The first contribution is the use of multi-objective Genetic Algorithm in the parameter pre-selection for SVM based control charts. The second contribution is the performance evaluation of supervised kernel based control charts. (3) Unsupervised kernel based control charts for anomaly intrusion detection. Two types of unsupervised kernel based control charts are investigated: Kernel PCA control charts and Support Vector Clustering based control charts. The applications of SVC based control charts on computer networks audit data are also discussed to demonstrate the effectiveness of the proposed method. Although the developed methodologies in this dissertation are demonstrated in the computer network intrusion detection applications, the methodologies are also expected to be applied to other complex system monitoring, where the database consists of a large dimensional data with non-Gaussian distribution.

SVC-Based Multivariate Control Charts for Automatic Anomaly Detection in Computer Networks

Anomaly detection through statistics-based machine learning for computer networks

Statistical-based monitoring of multivariate non-Gaussian systems

Application Of Sliding Nest Window Control Chart In Data Stream Anomaly Detection

The Study on Multivariate Time Series Anomaly Detection Via Convolutional Variational Autoencoder

Distributed Online One-Class Support Vector Machine for Anomaly Detection over Networks

CANet: Convolutional Attention-based Network for Multivariate Time Series Anomaly Detection

A Hybrid Algorithm Incorporating Vector Quantization and One-Class Support Vector Machine for Industrial Anomaly Detection

Ch-Svm Based Network Anomaly Detection

Principal component analysis-based control charts for multivariate nonnormal distributions

Self-adaptive Statistical Process Control for Anomaly Detection in Time Series.

Self-Supervised Variational Graph Autoencoder for System-Level Anomaly Detection

A distance-based control chart for monitoring multivariate processes using support vector machines

Anomaly Detection for Industrial Control Networks using Machine Learning with the help from the Inter-Arrival Curves

Time Series Anomaly Detection for ICS via Multidimensional Features and Spectral Residuals

Sparse abnormality detection based on variable selection for spatially correlated multivariate process

An Efficient Control Chart for Monitoring Unweighted Networks With Overlapping Communities

Network Anomaly Detection Using Dissimilarity-Based One-Class Svm Classifier

An Effective Multivariate Control Chart for Detecting Small Mean Shifts Using Support Vector Data Description

Graph Spatiotemporal Process for Multivariate Time Series Anomaly Detection with Missing Values

Using WPCA and EWMA Control Chart to Construct a Network Intrusion Detection Model