A data-driven metric learning-based scheme for unsupervised network anomaly detection. (January 2019)

• Record Type: Journal Article
• Authors: Aliakbarisani, Roya; Ghasemi, Abdorasoul; Felix Wu, Shyhtsun
• Is Part Of: Computers & electrical engineering. Volume 73(2019)
• Page Start: 71
• Page End: 83
• Publication Date: 2019-01
• Subjects: Network anomaly detection -- Metric learning -- Linear feature transformation -- Clustering methods -- Similarity/dissimilarity constraints; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2018.11.003
• Languages: English
• ISSNs: 0045-7906

Abstract

Abstract: Most network anomaly detection systems (NADSs) rely on the distance between the connections' feature vectors to identify attacks. Traditional distance metrics are inefficient for these systems as they deal with heterogeneous features of network connections. In this paper, we address a clustering-based NADS employing a data-driven distance metric. This metric is the outcome of a proposed metric learning method, which extracts its required side information from the training samples. The learned transformation matrix maps the connections' features to a new feature space in which similar and dissimilar connections are more well-separated while the local neighborhood information of the connections' features is preserved using the Laplacian Eigenmap technique. The proposed NADS is evaluated over the Kyoto 2006+ and NSL-KDD datasets. The experimental results show that it has superior performance in comparison with a recent SVM-clustering based NADS that employs the traditional Euclidean distance function.