Abstract:The identification of anomalous activities is a challenging and crucially important task in sensor networks. This task is becoming increasingly complex with the increasing volume of data generated in real-world domains, and greatly benefits from the use of predictive models to identify anomalies in real time. A key use case for this task is the identification of misbehavior that may be caused by involuntary faults or deliberate actions. However, currently adopted anomaly detection methods are often affected by limitations such as the inability to analyze large-scale data, a reduced effectiveness when data presents multiple densities, a strong dependence on user-defined threshold configurations, and a lack of explainability in the extracted predictions. In this paper, we propose a distributed deep learning method that extends growing hierarchical self-organizing maps, originally designed for clustering tasks, to address anomaly detection tasks. The SOM-based modeling capabilities of the method enable the analysis of data with multiple densities, by exploiting multiple SOMs organized as a hierarchy. Our map-reduce implementation under Apache Spark allows the method to process and analyze large-scale sensor network data. An automatic threshold-tuning strategy reduces user efforts and increases the robustness of the method with respect to noisy instances. Moreover, an explainability component resorting to instance-based feature ranking emphasizes the most salient features influencing the decisions of the anomaly detection model, supporting users in their understanding of raised alerts. Experiments are conducted on five real-world sensor network datasets, including wind and photovoltaic energy production, vehicular traffic, and pedestrian flows. Our results show that the proposed method outperforms state-of-the-art anomaly detection competitors. Furthermore, a scalability analysis reveals that the method is able to scale linearly as the data volume presented increases, leveraging multiple worker nodes in a distributed computing setting. Qualitative analyses on the level of anomalous pollen in the air further emphasize the effectiveness of our proposed method, and its potential in determining the level of danger in raised alerts.

An Adaptive Growing Hierarchical Self Organizing Map for Network Intrusion Detection

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

Research on Intrusion Detection Based on an Improved GHSOM

An Enhanced GHSOM for the Intrusion Detection

Application of Supervised SOM Neural Network in Intrusion Detection

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

A hybrid neural network approach to the classification of novel attacks for intrusion detection

Research on Intrusion Detection Based on an Improved SOM Neural Network

A DATA ANALYZER IN NETWORK ANOMALY DETECTION SYSTEM BASED ON HIERARCHICAL SELF-ORGANIZING MAP

An Intrusion Detection System Model Based on Self-Organizing Map

Distributed and explainable GHSOM for anomaly detection in sensor networks

Network Anomaly Detection Based on DSOM and ACO Clustering

Intrusion detection based on dynamic self-organizing map neural network clustering

A hybrid artificial immune system and Self Organising Map for network intrusion detection

Correlating Intrusion Alerts Into Attack Scenarios Based On Improved Evolving Self-Organizing Maps

Self-Organizing Map assisted Deep Autoencoding Gaussian Mixture Model for Intrusion Detection

A New Multi-Level Semi-Supervised Learning Approach for Network Intrusion Detection System Based on the ‘GOA’

An Intrusion Detection Framework Based on Hybrid Multi-Level Data Mining

Heterogeneous Domain Adaptation for IoT Intrusion Detection: A Geometric Graph Alignment Approach

An Adaptive Anomaly Detection Based on Hierarchical Clustering

A novel hybrid hunger games algorithm for intrusion detection systems based on nonlinear regression modeling