Abstract:<p>Network behavior analysis is an active and challenging research direction in anomalous network traffic detection. With rapidly-increasing popularity of online applications, network traffic volume has grown exponentially. In the meantime, network communication is becoming more complex. Consequently, new interaction patterns of network behaviors, named group activity, need to be investigated. Group activities can be generated by various hosts over the network and changes in group activities usually cannot be captured by traditional anomaly detection methods. Currently, the primary limitation of traditional flow-based methods for network traffic analysis is the lack of a mechanism that studies the social relationship in the interaction patterns between hosts. Besides, existing approaches fail to detect group activities. To overcome these limitations, the paper aims to detect anomalous hosts based on the profile of group activity evolution. We propose a mathematical method to quantify and detect anomalous group activities based on the stability of group activity evolution, which fully captures both the temporal and structural characteristics of network evolution. This anomaly detection algorithm is called GAP (Group Activity Profile), which is a powerful supplement and extension of the traditional method of network behavior analysis. The main contributions of this paper are: (1) the paper introduces a new perspective of the group activity based on network evolution and network behavior anomaly detection; (2) the algorithm is suitable for measuring the changes in group activity evolution and determining whether the current evolution relatively conforms to or deviates from the normal evolution; and (3) this work defines the baseline of the group activity evolution by applying historical characteristics that can significantly reduce the false positive rate, and detect anomalous hosts accurately. The results of experiments conducted on real datasets demonstrate that GAP is capable of detecting anomalous host more effectively than traditional methods. GAP is free of parameters and achieves high scalability, which can effectively identify group activities as well as accurately detect anomalous hosts over time.</p>

A Method for Host Abnormal Detection Based on Resource Availability

RE SEARCH ON EN ERGY SPEC TRUM ANOM ALY DE TEC TION METHOD FOR STATE CON TROL RA DI A TION EN VI RON MEN TAL MON I TOR ING BASED ON LOF AL GO RITHM

Security Evaluation Method Based on Host Resource Availability

Discovering Host Anomalies in Multi-source Information

A Method for Data Collection and Real-Time Anomaly Detection of Lightweight Hosts

LMHADC: Lightweight Method for Host Based Anomaly Detection in Cloud Using Mobile Agents

Computer Static System Resource Anomaly Detection Algorithm Based on Immune Principle

Learning Multi-Pattern Normalities in the Frequency Domain for Efficient Time Series Anomaly Detection

A Behavior Sequence Clustering-based Enterprise Network Anomaly Host Recognition Method

Abnormal Data Detection Based on Adaptive Sliding Window and Weighted Multiscale Local Outlier Factor for Machinery Health Monitoring

Algorithm for detecting anomalous hosts based on group activity evolution

Symmetry Degree Measurement and Its Applications to Anomaly Detection

Resource-Aware Performance Diagnostic Method for Web Applications

A Resource Allocation Algorithm Based on Heterogeneous Resources in Cloud Environment

Algorithmic Recourse for Anomaly Detection in Multivariate Time Series

Robust Anomaly Detection for Time-series Data

Design and Implementation of Adaptive Intrusion Detection System Based on Web Access Behavior Relevancy

Anomaly Detection in Heterogeneous Time Series Data for Server-Monitoring Tasks.

Behavior Pattern Mining from Traffic and Its Application to Network Anomaly Detection

Network Anomaly Detection and Localization

User Abnormal Behavior Analysis Based on Neural Network Clustering