Abstract:The identification of anomalous activities is a challenging and crucially important task in sensor networks. This task is becoming increasingly complex with the increasing volume of data generated in real-world domains, and greatly benefits from the use of predictive models to identify anomalies in real time. A key use case for this task is the identification of misbehavior that may be caused by involuntary faults or deliberate actions. However, currently adopted anomaly detection methods are often affected by limitations such as the inability to analyze large-scale data, a reduced effectiveness when data presents multiple densities, a strong dependence on user-defined threshold configurations, and a lack of explainability in the extracted predictions. In this paper, we propose a distributed deep learning method that extends growing hierarchical self-organizing maps, originally designed for clustering tasks, to address anomaly detection tasks. The SOM-based modeling capabilities of the method enable the analysis of data with multiple densities, by exploiting multiple SOMs organized as a hierarchy. Our map-reduce implementation under Apache Spark allows the method to process and analyze large-scale sensor network data. An automatic threshold-tuning strategy reduces user efforts and increases the robustness of the method with respect to noisy instances. Moreover, an explainability component resorting to instance-based feature ranking emphasizes the most salient features influencing the decisions of the anomaly detection model, supporting users in their understanding of raised alerts. Experiments are conducted on five real-world sensor network datasets, including wind and photovoltaic energy production, vehicular traffic, and pedestrian flows. Our results show that the proposed method outperforms state-of-the-art anomaly detection competitors. Furthermore, a scalability analysis reveals that the method is able to scale linearly as the data volume presented increases, leveraging multiple worker nodes in a distributed computing setting. Qualitative analyses on the level of anomalous pollen in the air further emphasize the effectiveness of our proposed method, and its potential in determining the level of danger in raised alerts.

An Enhanced GHSOM for the Intrusion Detection

Research on Intrusion Detection Based on an Improved GHSOM

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

A DATA ANALYZER IN NETWORK ANOMALY DETECTION SYSTEM BASED ON HIERARCHICAL SELF-ORGANIZING MAP

Application of Supervised SOM Neural Network in Intrusion Detection

Classification of DNS Queries for Anomaly Detection

PhoGAD: Graph-based Anomaly Behavior Detection with Persistent Homology Optimization

Research on Intrusion Detection Based on an Improved SOM Neural Network

Distributed and explainable GHSOM for anomaly detection in sensor networks

Network Anomaly Detection Based on DSOM and ACO Clustering

Pattern Discovery from Time Series Using Growing Hierarchical Self-Organizing Map

A hybrid neural network approach to the classification of novel attacks for intrusion detection

HGDom: Heterogeneous Graph Convolutional Networks for Malicious Domain Detection

Deepdom: Malicious Domain Detection with Scalable and Heterogeneous Graph Convolutional Networks

Correlating Intrusion Alerts Into Attack Scenarios Based On Improved Evolving Self-Organizing Maps

A Hybrid Approach Of Http Anomaly Detection

scGHSOM: Hierarchical clustering and visualization of single-cell and CRISPR data using growing hierarchical SOM

Intrusion detection based on dynamic self-organizing map neural network clustering

An Intrusion Detection Framework Based on Hybrid Multi-Level Data Mining

A Hierarchical Hybrid Intrusion Detection Model for Industrial Internet of Things

Discovering New Analytical Methods For Large Volume Medical And Online Data Processing