Abstract:<p>Detecting anomalous discrete sequences such as payloads and syscall traces is a crucial task of network security analysis for discovering novel attacks. The data characteristics that lack of labels, very long sequences and irregularly variable lengths make generating proper representations for the sequences for anomaly detection quite challenging. Traditional methods combining shallow models with feature engineering require lots of time and effort from researchers. And they only catch short patterns for the sequences. Recently deep learning is paid more and more attention due to its excellent performance on data representation. Current works simply adopt recurrent neural network based models to this task. They learn the local patterns of the sequences but can not view the sequences globally. Besides, the variable length makes the deep models that accept fixed-size inputs unavailable. Moreover, the deep models usually lack interpretability. Here an unsupervised deep learning framework utilizing attention mechanism called ADSAD is proposed to address these issues. ADSAD takes both the data characteristics and the limitation of the deep models into consideration and generate the global representations for the sequences by two steps, in which the attention mechanism is applied to improve the interpretability. The empirical results showed that the ADSAD instances significantly outperformed the state-of-the-art deep models, with the relative AUC improvement of up to 7%. The attention mechanism not only enhanced the detection performance by up to 73% in terms of AUC but was also able to assist experts for anomaly analysis by visualization.</p>

An Anchor-Guided Sequence Labeling Model for Event Detection in Both Data-Abundant and Data-Scarce Scenarios.

Label-Aware Chinese Event Detection with Heterogeneous Graph Attention Network

A New Method of Time-Series Event Prediction Based on Sequence Labeling

IMPROVING EVENT DETECTION BY EXPLOITING LABEL HIERARCHY

Event Detection via Gated Multilingual Attention Mechanism.

Enhancing Neural Sequence Labeling with Position-Aware Self-Attention.

An Anchor-Free Network with Density Map and Attention Mechanism for Multiscale Object Detection in Aerial Images

Event-based Object Detection with Lightweight Spatial Attention Mechanism

Learning Discriminative Neural Representations for Event Detection

Injecting Text Clues for Improving Anomalous Event Detection From Weakly Labeled Videos

ADSAD: An unsupervised attention-based discrete sequence anomaly detection framework for network security analysis

Event Detection As Graph Parsing

A New Anchor-Labeling Method for Oriented Text Detection Using Dense Detection Framework

A Two-Stage Label Rectification Framework for Noisy Event Extraction.

Hierarchical Attention Neural Network for Event Types to Improve Event Detection.

Detecting Text in Scene and Traffic Guide Panels With Attention Anchor Mechanism

Team RUC_AIM3 Technical Report at Activitynet 2020 Task 2: Exploring Sequential Events Detection for Dense Video Captioning

A dynamic label assignment strategy for one-stage detectors

Label Attention Network for Temporal Sets Prediction: You Were Looking at a Wrong Self-Attention

Label Attention Network for Structured Prediction

A neural model for joint event detection and prediction