Abstract:In recent years, detecting anomalies in real-world computer networks has become a more and more challenging task due to the steady increase of high-volume, high-speed and high-dimensional streaming data, for which ground truth information is not available. Efficient detection schemes applied on networked embedded devices need to be fast and memory-constrained, and must be capable of dealing with concept drifts when they occur. Different approaches for unsupervised online outlier detection have been designed to deal with these circumstances in order to reliably detect malicious activity. In this paper, we introduce a novel framework called PCB-iForest, which generalized, is able to incorporate any ensemble-based online OD method to function on streaming data. Carefully engineered requirements are compared to the most popular state-of-the-art online methods with an in-depth focus on variants based on the widely accepted isolation forest algorithm, thereby highlighting the lack of a flexible and efficient solution which is satisfied by PCB-iForest. Therefore, we integrate two variants into PCB-iForest—an isolation forest improvement called extended isolation forest and a classic isolation forest variant equipped with the functionality to score features according to their contributions to a sample’s anomalousness. Extensive experiments were performed on 23 different multi-disciplinary and security-related real-world datasets in order to comprehensively evaluate the performance of our implementation compared with off-the-shelf methods. The discussion of results, including AUC, F1 score and averaged execution time metric, shows that PCB-iForest clearly outperformed the state-of-the-art competitors in 61% of cases and even achieved more promising results in terms of the tradeoff between classification and computational costs.

Edge computing empowered anomaly detection framework with dynamic insertion and deletion schemes on data streams

Fast Wireless Sensor Anomaly Detection based on Data Stream in Edge Computing Enabled Smart Greenhouse

Isolation Forest Based Anomaly Detection Framework on Non-IID Data

An edge computing based anomaly detection method in IoT industrial sustainability

Federated Learning-Based Anomaly Detection with Isolation Forest in the IoT-Edge Continuum

An Intelligent Edge Dual-Structure Ensemble Method for Data Stream Detection and Releasing

A Real-Time Detection Method for Abnormal Data of Internet of Things Sensors Based on Mobile Edge Computing

Adaptive Anomaly Detection for IoT Data in Hierarchical Edge Computing

Human-machine interactive streaming anomaly detection by online self-adaptive forest

Accurate Anomaly Detection with Energy-Efficiency in IoT-Edge-Cloud Collaborative Networks

A distributed sensing data anomaly detection scheme

On the Improvement of the Isolation Forest Algorithm for Outlier Detection with Streaming Data

Anomaly Detection in Network Management System Based on Isolation Forest

OptIForest: Optimal Isolation Forest for Anomaly Detection

Anomaly detection with a container-based stream processing framework for industrial internet of things

LightESD: Fully-Automated and Lightweight Anomaly Detection Framework for Edge Computing

Real-Time Deep Anomaly Detection Framework for Multivariate Time-Series Data in Industrial IoT

Extending Isolation Forest for Anomaly Detection in Big Data via K-Means

LSHiForest: A Generic Framework for Fast Tree Isolation Based Ensemble Anomaly Analysis.

Real-time anomaly detection of short-term traffic disruptions in urban areas through adaptive isolation forest

An Anomaly Detection Algorithm Selection Service for IoT Stream Data Based on Tsfresh Tool and Genetic Algorithm