Abstract:The identification of anomalous activities is a challenging and crucially important task in sensor networks. This task is becoming increasingly complex with the increasing volume of data generated in real-world domains, and greatly benefits from the use of predictive models to identify anomalies in real time. A key use case for this task is the identification of misbehavior that may be caused by involuntary faults or deliberate actions. However, currently adopted anomaly detection methods are often affected by limitations such as the inability to analyze large-scale data, a reduced effectiveness when data presents multiple densities, a strong dependence on user-defined threshold configurations, and a lack of explainability in the extracted predictions. In this paper, we propose a distributed deep learning method that extends growing hierarchical self-organizing maps, originally designed for clustering tasks, to address anomaly detection tasks. The SOM-based modeling capabilities of the method enable the analysis of data with multiple densities, by exploiting multiple SOMs organized as a hierarchy. Our map-reduce implementation under Apache Spark allows the method to process and analyze large-scale sensor network data. An automatic threshold-tuning strategy reduces user efforts and increases the robustness of the method with respect to noisy instances. Moreover, an explainability component resorting to instance-based feature ranking emphasizes the most salient features influencing the decisions of the anomaly detection model, supporting users in their understanding of raised alerts. Experiments are conducted on five real-world sensor network datasets, including wind and photovoltaic energy production, vehicular traffic, and pedestrian flows. Our results show that the proposed method outperforms state-of-the-art anomaly detection competitors. Furthermore, a scalability analysis reveals that the method is able to scale linearly as the data volume presented increases, leveraging multiple worker nodes in a distributed computing setting. Qualitative analyses on the level of anomalous pollen in the air further emphasize the effectiveness of our proposed method, and its potential in determining the level of danger in raised alerts.

A DATA ANALYZER IN NETWORK ANOMALY DETECTION SYSTEM BASED ON HIERARCHICAL SELF-ORGANIZING MAP

Entropy-Defined Direct Batch Growing Hierarchical Self-Organizing Mapping for Efficient Network Anomaly Detection

A Modified Hybrid Method Based on PSO, GA, and K-Means for Network Anomaly Detection

Distributed and explainable GHSOM for anomaly detection in sensor networks

Research on Intrusion Detection Based on an Improved GHSOM

Self-organizing Map As a New Method for Clustering and Data Analysis

A Hierarchical Approach to Conditional Random Fields for System Anomaly Detection

Multiresolution dendritic cell algorithm for network anomaly detection

Univariate Time Series Anomaly Detection Based on Hierarchical Attention Network

An Effective Method for Computer Network Anomaly Detection

Multi-source data based anomaly detection through temporal and spatial characteristics

Graph-level Anomaly Detection via Hierarchical Memory Networks

MSCA: an Unsupervised Anomaly Detection System for Network Security in Backbone Network.

A hybrid artificial immune system and Self Organising Map for network intrusion detection

Anomaly detection in wide area network mesh using two machine learning anomaly detection algorithms

Anomaly Detection Based on Traffic Information Structure

Research of Anomaly Detection System Based on Data Mining

An Ontological Approach to the Detection of Anomalies in Vehicular Ad Hoc Networks

Hierarchical Temporal Memory method for time-series-based anomaly detection

High-speed anomaly traffic detection based on staged frequency domain features

The DCA:SOMe Comparison A Comparative Study Between Two Biologically-Inspired Algorithms