Abstract:Intrusion detection is an important technique in the defense-in-depth network security framework. Most current intrusion detection models lack the ability to process massive audit data streams for real-time anomaly detection. In this paper, we present an effective anomaly intrusion detection model based on Principal Component Analysis (PCA). The model is more suitable for high speed processing of massive data streams in real-time from various data sources by considering the frequency property of audit events than by use of the transition property or the correlation property. It can serve as a general framework that a practical Intrusion Detection Systems (IDS) can be implemented in various computing environments. In this method, a multi-pronged anomaly detection model is used to monitor various computer system and network behaviors. Three sources of data, system call data from the University of New Mexico (lpr) and from KLINNS Lab of Xi'an Jiaotong University (ftp), shell command data from AT&T Research laboratory, and network data from MIT Lincoln Lab, are used to validate the model and the method. The frequencies of individual system calls generated by one process and of individual commands embedded in one command block as well as features extracted in one network connection are transformed into an input data vector. Our method is employed to reduce the high dimensional data vectors and thus the detection is handled in a lower dimension with high efficiency and low use of system resources. The distance between a vector and its reconstruction in the reduced subspace is used for anomaly detection. Empirical results show that our model is promising in terms of detection accuracy and computational efficiency, and thus amenable for real-time intrusion detection.

Lcad: A Correlation Based Abnormal Pattern Detection Approach For Large Amount Of Monitor Data

An Anomaly Detection Approach for Multiple Monitoring Data Series Based on Latent Correlation Probabilistic Model.

An Unsupervised Framework for Anomaly Detection in a Water Treatment System

The Application of a Double CUSUM Algorithm in Industrial Data Stream Anomaly Detection

Hierarchical Density Decompositions for Abnormal Event Diagnosis in Serially Correlated Non-Gaussian Systems

Correlated Anomaly Detection from Large Streaming Data

Anomaly Detection of Pollution Control Equipment Based on AMI Data Analytics

Learning Multi-Pattern Normalities in the Frequency Domain for Efficient Time Series Anomaly Detection

Practical Anomaly Detection over Multivariate Monitoring Metrics for Online Services

MonitorAssistant: Simplifying Cloud Service Monitoring Via Large Language Models

CSCAD: Correlation Structure-Based Collective Anomaly Detection in Complex System

Predictive Monitoring Of Local Anomalies In Clinical Treatment Processes

Deep Learning-based Anomaly Detection in Cyber-physical Systems

Processing of Massive Audit Data Streams for Real-Time Anomaly Intrusion Detection

A Real-Time Detection Method for Abnormal Data of Internet of Things Sensors Based on Mobile Edge Computing

Abnormal Data Detection and Identification Method of Distribution Internet of Things Monitoring Terminal Based on Spatiotemporal Correlation

Rapid Deployment of Anomaly Detection Models for Large Number of Emerging KPI Streams.

Unsupervised Deep Anomaly Detection for Multi-Sensor Time-Series Signals

LPC-AD: Fast and Accurate Multivariate Time Series Anomaly Detection via Latent Predictive Coding

Enhanced multicorrelation block process monitoring and abnormity root cause analysis for distributed industrial process: A visual data-driven approach

Crowd-level Abnormal Behavior Detection via Multi-scale Motion Consistency Learning