Unsupervised ensemble anomaly detection through time-periodical packet sampling

Shuichi Nawata*, Masato Uchida, Yu Gu, Masato Tsuru, Yuji Oie


研究成果: Conference contribution

7 被引用数 (Scopus)


We propose an anomaly detection method that trains a baseline model describing the normal behavior of network traffic without using manually labeled traffic data. The trained baseline model is used as the basis for comparison with the audit network traffic. The proposed method can be carried out in an unsupervised manner through the use of time-periodical packet sampling for a different purpose from which it was intended. That is, we take advantage of the lossy nature of packet sampling for the purpose of extracting normal packets from the unlabeled original traffic data. By using real traffic traces, we show that the proposed method is comparable in terms of false positive and false negative rates on detecting anomalies regarding TCP SYN packets to the conventional method that requires manually labeled traffic data to train the baseline model. In addition, in order to mitigate the possible performance variation due to probabilistic nature of sampled traffic data, we devise an ensemble anomaly detection method that exploits multiple baseline models in parallel. Experimental results show that the proposed ensemble anomaly detection performs well and is not affected by the variability of time-periodical packet sampling.

ホスト出版物のタイトルINFOCOM 2010 - IEEE Conference on Computer Communications Workshops
出版ステータスPublished - 2010 6月 29
イベントIEEE Conference on Computer Communications Workshops, INFOCOM 2010 - San Diego, CA, United States
継続期間: 2010 3月 152010 3月 19


名前Proceedings - IEEE INFOCOM


OtherIEEE Conference on Computer Communications Workshops, INFOCOM 2010
国/地域United States
CitySan Diego, CA

ASJC Scopus subject areas

  • コンピュータ サイエンス(全般)
  • 電子工学および電気工学


「Unsupervised ensemble anomaly detection through time-periodical packet sampling」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。